Font size
WorksheetsAISS - AWS SA - Acloudguru
Total questions: 65
Worksheet time: 3hrs 47mins
(from acloudguru - practice Exam)
Your company has hired a young and enthusiastic accountant. After reviewing the AWS documentation and usage graphs, he announces that you are wasting vast amounts of money running servers for a full hour instead of spinning them up only when they are needed and down again as soon as they are idle for 1 minute. He cites the AWS claim that you only pay for what you use, and that as a senior engineer, you should be more conscious of wasting company money. How do you respond?
You grudgingly acknowledge his point and change your scheduling and tuning settings.
You thank him for his concern, and advise him that he has misinterpreted the pricing document: Instances are billed by the full hour, and partial hours are billed as such. Additionally, storage charges are incurred even if the Db instance sits idle. Taking into account productivity losses, stopping and restarting Db instances may actually result in additional costs. As such, your solution is fine as it now stands.
You leap across the meeting table and slap him for insulting you in front of your peers.
You acknowledge the problem and propose that you could downsize the instances so that the workload over the hour consumes the full instance capacity for the full hour. You might also propose closer monitoring and automation to allow you to up-size and down-size the instance each hour over the day to match the instance performance to the anticipated workload.
(from acloudguru - practice Exam)
A user of your web-site makes an HTTP request to access a static resource on your server. The request is automatically redirected to the nearest CloudFront server. For some reason, the requested resource does not exist on the CloudFront server. Which of the following is true?
The request will be put on hold until the resource has been cached at the edge location
The request will be sent to the nearest available edge location that contains that resource
Your user will receive a 404 error.
Cloudfront will query the origin server and then cache the resource on the edge location.
(from acloudguru - practice Exam)
Which of the following Amazon S3 Storage Classes offer 99.999999999% (11 x 9s) durability?
Standard, Standard-Infrequent Access, One Zone-Infrequent Access
Standard-Infrequent Access, One Zone-Infrequent Access, Reduced Redundancy Storage
Reduced Redundancy Storage, Standard, One Zone-Infrequent Access
Standard, Glacier, Reduced Redundancy Storage
(from acloudguru - practice Exam)
You work for a large software company in Seattle. They have their production environment provisioned on AWS inside a custom VPC. The VPC contains both a public and private subnet. The company tests their applications on custom EC2 instances inside a private subnet. There are approximately 500 instances, and they communicate to the outside world via a proxy server. At 3am every night, the EC2 instances pull down OS updates, which are usually 150MB or so. They then apply these updates and reboot: if the software has not downloaded within half an hour, then the update will attempt to download the following day. You notice that a number of EC2 instances are continually failing to download the updates in the allotted time. Which of the following answers might explain this failure? (Choose 2)
Your proxy server is blacklisting the address in which the updates are being downloaded from, resulting in failed downloads.
The proxy server is in a private subnet and uses a NAT instance to connect to the internet. However, this instance is too small to handle the required network traffic. You should re-provision the NAT solution so that it's able to handle the throughput.
The proxy server is on an inadequately sized EC2 instance and does not have sufficient network throughput to handle all updates simultaneously. You should increase the instance size or type of the EC2 instance for the proxy server.
The proxy server has an inadequately sized EBS volume attached to it. The network buffer is stored on the EBS volume, and it is running out of disk space when trying to buffer the 500 simultaneous connections. You should provision an EBS volume with provisioned IOPS.
The proxy server has only one elastic IP address added to it. To increase network throughput, you should add additional elastic IP addresses.
(from acloudguru - practice Exam)
You are a solutions architect working for a biotech company who is pioneering research in immunotherapy. They have developed a new cancer treatment that may be able to cure up to 94% of cancers. They store their research data on S3. However, an intern recently deleted some critical files accidentally. You've been asked to prevent this from happening in the future. Which of the following solutions can be used to prevent accidental data loss?
Create an IAM bucket policy that disables deletes.
Make sure the interns can only access data on S3 using signed URLs.
Use S3 Infrequently Accessed storage to store the data on.
Enable S3 versioning on the bucket & enable MFA Delete on the bucket.
(from acloudguru - practice Exam)
You've been tasked with building a new application with a stateless web tier for a company that produces reusable rocket parts. Which three services could you use to achieve this?
ELB, ElastiCache, and RDS
Cloudwatch, RDS, and DynamoDb
AWS Storage Gateway, ElastiCache, and ELB
RDS, DynamoDB, and ElastiCache
(from acloudguru - practice Exam)
Your company has decided to set up a new AWS account for test and dev purposes. They already use AWS for production, but would like a new account dedicated for test and dev so as to not accidentally break the production environment. You launch an exact replica of your production environment using a CloudFormation template that your company uses in production. However, CloudFormation fails. You use the exact same CloudFormation template in production, so the failure is something to do with your new AWS account. The CloudFormation template is trying to launch 60 new EC2 instances in a single availability zone. After some research you discover that the problem is ________.
For all new AWS accounts, there is a soft limit of 20 EC2 instances per availability zone. You should submit the limit increase form and retry the template after your limit has been increased.
For all new AWS accounts, there is a soft limit of 20 EC2 instances per region. You should submit the limit increase form and retry the template after your limit has been increased.
You cannot launch more than 20 instances in your default VPC. Instead, reconfigure the CloudFormation template to provision the instances in a custom VPC.
Your CloudFormation template is configured to use the parent account and not the new account. Change the account number in the CloudFormation template and relaunch the template.
(from acloudguru - practice Exam)
A client is concerned that someone other than approved administrators is trying to gain access to the Linux web app instances in their VPC. She asks what sort of network access logging can be added. Which of the following might you recommend? (Choose 2)
Set up a traffic logging rule on the VPC firewall appliance and direct the log to CloudWatch or S3.
Set up a Flow Log for the group of instances and forward them to CloudWatch.
Set up a Flow Log for the group of instances and forward them to S3.
Use Event Log filters to trigger alerts that are forwarded to CloudWatch
Make use of an OS level logging tools such as iptables and log events to CloudWatch or S3.
(from acloudguru - practice Exam)
Which of the following RDS database engines have a limit to the amount of databases that can run per instance? (Choose 2)
Oracle
Amazon Aurora
PostgreSQL
SQL Server
(from acloudguru - practice Exam)
With SAML-enabled single sign-on, ________. (Choose 2)
After the client browser posts the SAML assertion, AWS sends the sign-in URL as a redirect, and the client browser is redirected to the Console.
The client browser is immediately directed to the AWS Console.
The portal acknowledges a SAML authentication response, then verifies the user's identity in your organization.
The portal first verifies the user's identity in your organization, then generates a SAML authentication response.
(from acloudguru - practice Exam)
When it comes to Security Groups within a custom VPC, which of the following statements are correct? (Choose 2)
Security Groups are stateful.
Updates to security groups are applied immediately.
Security Groups are stateless.
Updates to security groups are not applied immediately, however they are applied within the hour in which they are made.
(from acloudguru - practice Exam)
You successfully configure VPC Peering between VPC-A and VPC-B. You then establish an IGW and a Direct-Connect connection in VPC-B. Can instances in VPC-A connect to your corporate office via the Direct-Connect service, and connect to the Internet via the IGW?
VPC peering does not support edge to edge routing.
Instances in VPC-A will be able to access the corporate office, but not the Internet.
Instances in VPC-A will be able to access the Internet, but not the corporate office.
Yes: VPC Peering is designed to route traffic between the VPCs.
(from acloudguru - practice Exam)
You are leading a design team to implement an urgently needed collection and analysis project. You will be collecting data for an array of 50,000 anonymous data collectors which will be summarized each day and then rarely used again. The data will be pulled from collectors approximately once an hour. The Dev responsible for the DynamoDB design is concerned about how to design the Partition and Local keys to ensure efficient use of the DynamoDB tables. What advice would you provide. (Choose 2)
Use a Date-based partition key to avoid having to hop from partition to partition.
Don't worry about it: AWS will optimize the table and partitions to meet our needs.
Use a time-based partition key so that it is easy to query and analyze.
Create a new table each day, and reconfigure the old table for infrequent use after the summation is complete.
Insert a calculated hash in front of the Date/Time value in the partition key to force DynamoDB to use partitions in parallel.
(from acloudguru - practice Exam)
You are a systems administrator and you need to monitor the health of your production environment. You decide to do this using CloudWatch. However, you notice that you cannot see the health of every important metric in the default dashboard. When monitoring the health of your EC2 instances, for which of the following metrics do you need to design a custom CloudWatch metric?
CPU Usage
Disk read operations
Memory usage
Network in
(from acloudguru - practice Exam)
Your company has asked you to investigate the use of KMS for storing and managing keys in AWS. From the options listed below, what key management features are available in KMS?
Generate keys, disable and delete keys, operate as a private, native Hardware Security Module (HSM)
Import your own keys, disable and re-enable keys and define key management roles in IAM
Import your own keys, disable and re-enable keys and migrate keys between the default KMS key store and a custom key store
Generate keys, disable and re-enable keys and import keys into a custom key store
(from acloudguru - practice Exam)
How is the Public IP address managed in an instance session via the instance GUI/RDP or Terminal/SSH session?
For security reasons, the Public IP address is a hidden value.
The Public IP address can be managed via the instance MetaData at http://169.254.169.254/latest/meta-data/local-ipv4.
The Public IP address can be managed via the instance MetaData at http://169.254.169.254/latest/meta-data/public-ipv4.
The Public IP address is not managed on the instance: It is, instead, an alias applied as a network address translation of the Private IP address.
(from acloudguru - practice Exam)
In which of the following ways can security privileges be granted to Docker containers? (Choose 2)
Role granted to a single running container in ECS
Role granted to an ECS Service
Role granted to an ECS Task
Image in ECR
Role granted to ECS Container Instances
(from acloudguru - practice Exam)
By definition, a public subnet within a VPC is one that ________.
Has at least one route in its routing table that routes via a Network Address Translation (NAT) instance.
Has at least one route in its routing table that uses an Internet Gateway (IGW).
Where the Network Access Control List (NACL) is permitting outbound traffic to 0.0.0.0/0.
Has had the public subnet check box ticked when setting up this subnet in the VPC console.
(from acloudguru - practice Exam)
You are a solutions architect with a manufacturing company running several legacy applications. One of these applications needs to communicate with services which are currently hosted on-premise. The people who wrote this application have left the company, and there is no documentation describing how the application works. You need to ensure that this application can be hosted in a bespoke VPC, but remains able to communicate to the back-end services hosted on-premise. Which of the following answers will allow the application to communicate back to the on premise equipment without the need to reprogram the application? (Choose 3)
You should configure your Elastic Load Balancer to act as a reverse proxy so that the EC2 instance can communicate back to the on-premise data center.
You should configure an AWS Direct Connect link between the VPC and the site with the on-premise solution.
You should attach an Elastic IP address to the VPC so that it will be able to communicate with the on-premise site.
You should configure the VPC subnet in which the application sits so that it does not have an IP address range that conflicts with that of the on-premise VLAN in which the back end services sit.
You should ensure the VPC has an internet gateway attached to it. That way, you can establish a site-to-site VPN with the on-premise environment.
(from acloudguru - practice Exam)
You have been asked by your employer to create an identical copy of your production environment in another Region for disaster recovery purposes. In the list below, which AWS resources would you NOT need to recreate, because they are available universally across the console? (Choose 2)
Elastic Load Balancers
Identity Access Management Roles
Route53
EC2 Key Pairs
Security Groups
(from acloudguru - practice Exam)
Your company has a policy of encrypting all data at rest. You host your production environment on EC2 in a bespoke VPC. Attached to your EC2 instances are multiple EBS volumes, and you must ensure this data is encrypted. Which of the following options will allow you to do this? (Choose 3)
Install SSL certificates on the servers so as to encrypt your data
Use third party volume encryption tools.
Encrypt the data using native encryption tools available in the operating system (such as windows bitlocker).
Encrypt your data inside your application, before storing it on EBS.
EBS Volumes are encrypted by default. You do not need to do anything.
(from acloudguru - practice Exam)
You have developed a new web application in us-west-2 that requires six Amazon Elastic Compute Cloud (EC2) instances running at all times. You have three availability zones available in that region (us-west-2a, us-west-2b, and us-west-2c). You need 100 percent fault tolerance if any single Availability Zone in us-west-2 becomes unavailable. Which of the following answers offers two correct solutions to this scenario?
Solution 1 - Us-west-2a with three EC2 instances, us-west-2b with three EC2 instances, and us-west-2c with three EC2 instances. Solution 2 - Us-west-2a with four EC2 instances, us-west-2b with two EC2 instances, and us-west-2c with two EC2 instances.
Solution 1 - Us-west-2a with three EC2 instances, us-west-2b with three EC2 instances, and us-west-2c with no EC2 instances. Solution 2 - Us-west-2a with three EC2 instances, us-west-2b with three EC2 instances, and us-west-2c with three EC2 instances.
Solution 1 - Us-west-2a with two EC2 instances, us-west-2b with two EC2 instances, and us-west-2c with two EC2 instances. Solution 2 - Us-west-2a with six EC2 instances, us-west-2b with six EC2 instances, and us-west-2c with no EC2 instances
Solution 1 - Us-west-2a with six EC2 instances, us-west-2b with six EC2 instances, and us-west-2c with no EC2 instances. Solution 2 - Us-west-2a with three EC2 instances, us-west-2b with three EC2 instances, and us-west-2c with three EC2 instances.
(from acloudguru - practice Exam)
You run a meme creation website that stores the original images in S3 and each meme's meta data in DynamoDB. You need to decide upon a low-cost storage option for the memes, themselves. If a meme object is unavailable or lost, a Lambda function will automatically recreate it but at a $10 licencing cost per creation. Which storage solution should you use to store the memes in the most cost effective way?
S3 - IA
S3 - OneZone-IA
S3 - RRS
Glacier
S3
(from acloudguru - practice Exam)
Your company provides an online image recognition service and uses SQS to decouple system components. Your EC2 instances poll the image queue as often as possible to keep end-to-end throughput as high as possible, but you realize that all this polling is resulting in both a large number of CPU cycles and skyrocketing costs. How can you reduce cost without compromising service?
Enable short polling by setting the ReceiveMessageWaitTimeMinutes to a number > 0.
Enable long polling by setting the ReceiveMessageWaitTimeSeconds to a number > 0.
Enable long polling by setting the ReceiveMessageWaitTimeMinutes to a number > 0.
Enable short polling by setting the ReceiveMessageWaitTimeSeconds to a number > 0.
(from acloudguru - practice Exam)
You work for a large media organization who has traditionally stored all their media on large SAN arrays. After evaluating AWS, they have decided to move their storage to the cloud. Staff will store their personal data on S3, and will have to use their Active Directory credentials in order to authenticate. These items will be stored in a single S3 bucket, and each staff member will have their own folder within that bucket named after their employee ID. Which of the following steps should you take in order to help set this up? (Choose 3)
Create an IAM user for each member of staff and use their existing active directory password for the account.
Create an IAM role.
Tag each folder with the staff members ID.
Create either a federation proxy or identity provider.
Use AWS security token service to create temporary tokens.
(from acloudguru - practice Exam)
Which of the following AWS services allow native encryption of data, while at rest? (Choose 3)
S3
Elastic File System (EFS)
Elasticache for Memcached
Elastic Block Store (EBS)
(from acloudguru - practice Exam)
You work for a games development company who are re-architecting their production environment. They have decided to make all web servers stateless. Which of following the AWS services will help them achieve this goal? (Choose 3)
RDS
ElastiCache.
ELB
EMR
DynamoDB
(from acloudguru - practice Exam)
If you don't use one of the AWS SDKs, you can perform DynamoDB operations over HTTP using the POST request method. The POST method requires you to specify the operation in the header of the request and provide the data for the operation in JSON format in the body of the request. Which of the following are valid DynamoDB Headers attributes? (Choose 4)
content-type
host
MD5-Hash
x-amz-date
x-amz-target
(from acloudguru - practice Exam)
You work for a popular media outlet about to release a story that is expected to go viral. During load testing on the website, you discover that there is read contention on the database tier of your application. Your RDS instance consists of a MySQL database on an extra large instance. Which of the following approaches would be best to further scale this instance to meet the anticipated increase in traffic your viral story will generate? (Choose 3)
Shard the MySQL database into multiple copies.
Provision a larger instance size with provisioned IOPS.
Add an RDS Read Replica for increased read performance.
Use ElastiCache to cache the frequently read, static data.
Add an RDS Multi-AZ for increased read performance.
(from acloudguru - practice Exam)
A single m4.medium NAT instance inside a VPC supports a company of 100 people. This NAT instance allows individual EC2 instances in private subnets to communicate out to the internet without being directly accessible via the internet. As the company has grown over the last year, they are finding that the additional traffic through the NAT instance is causing serious performance degradation. What might you do to solve this problem?
Instead of using a NAT, use Direct Connect to route all traffic through your VPC and back out to the Internet.
Increase the class size of the NAT instance from an m4.medium to an m4.xLarge.
Use an Elastic Load Balancer and forward traffic out through this ELB. The ELB will automatically scale on demand as traffic increases.
Attach an additional IGW to your VPC.
(from acloudguru - practice Exam)
You have provisioned a custom VPC with a subnet that has a CIDR block of 10.0.3.0/28 address range. Inside this subnet, you have 2 webservers, 2 application servers, 2 database servers, and a NAT. You have configured an Autoscaling group on the two web servers to automatically scale when the CPU utilization goes above 90%. Several days later you notice that autoscaling is no longer deploying new instances into the subnet, despite the CPU utilization of all web servers being at 100%. Which of the following answers may offer an explanation? (Choose 2)
AWS reserves both the first four and the last IP address in each subnet's CIDR block.
Your Autoscaling Group (ASG) has provisioned too many EC2 instances and has exhausted the number of internal IP addresses available in the subnet.
Your internet gateway (IGW) on your VPC has provisioned too many EC2 instances.
AWS reserves both the first two and the last two IP addresses in each subnet's CIDR block.
AWS reserves both the first three and the last two IP addresses in each subnet's CIDR block.
(from acloudguru - practice Exam)
You are a solutions architect working for a busy media company with offices in Japan and the United States. Your production environment is hosted both in US-EAST-1 and AP-NORTHEAST-1. Your European users have been connecting to the production environment in Japan, and are seeing the site in Japanese rather than in English. You need to ensure that they view the English language version. Which of the routing policies could help you achieve this? (Choose 2)
Simple Routing
Geolocation
Failover Routing
Geoproximity Routing
Latency Based Routing
(from acloudguru - practice Exam)
Choose the features of Consolidated Billing. (Choose 3)
Multiple standalone accounts are combined and may reduce your overall bill
A single bill is issued containing the charges for all AWS Accounts
Charging is based per VPC
Account charges can be tracked individually
(from acloudguru - practice Exam)
When editing permissions (policies and ACLs), to whom does the concept of the "Owner" refer?
The "Owner" refers to the identity and email address used to create the AWS account.
There is no special concept of "Owner" in AWS.
The Owner is IAM Role used to create the object via the GUI, CLI, or API.
The Owner is the IAM user who created the object via the GUI, CLI, or API.
(from acloudguru - practice Exam)
You are a solutions architect working for a large anti-virus company and your job is to secure your company’s production AWS environment. A new policy dictates that a particular public facing subnet needs to allow RDP on port 3389 at the network ACL layer. You create an inbound rule allowing traffic to port 3389 on the ACL level. However, users complain that they still cannot connect. Which of the following answers may represent the root cause of the connectivity issues? (Choose 2)
Network Access Control lists are stateless.
Network Access Control lists are stateful.
You need to create an outbound rule allowing RDP response traffic to go back out again.
Updates to network access control lists can take time to propagate.
(from acloudguru - practice Exam)
You work for a genomics company that is developing a cure for motor neuron disease by using advanced gene therapies. As a part of their research, they take extremely large data sets (usually in the terabytes) and analyze these data sets using Elastic Map Reduce. In order to keep costs low, they run the analysis for only a few hours in the early hours of the morning, using spot instances for the task nodes. The core nodes are on-demand instances. Lately however the EMR jobs have been failing. This is due to spot instances being unexpectedly terminated. Which of the following remedies would both keep costs manageable and mitigate the issues caused by terminated spot instances? (Choose 2)
Change the core nodes to spot instances and lower the spot price.
Change the task nodes to on-demand instances.
Increase the bid price for the task nodes so that you have a greater threshold before the task nodes are terminated.
Increase the bid price for the core nodes.
(from acloudguru - practice Exam)
You working in the media industry, and you have created a web application where users will be able to upload photos they create to your website. This web application must be able to call the S3 API in order to be able to function. Where should you store your API credentials whilst maintaining the maximum level of security.
Don't save your API credentials. Instead create a role in IAM and assign this role to an EC2 instance when you first create it.
Save your API credentials in a public github repository.
Save the API credentials locally to each EC2 instance.
Get the API credentials using the EC2 instances User Data.
(from acloudguru - practice Exam)
You are running a media rich website with a global audience from us-east-1 for a customer in the publishing industry. The website updates every 20 minutes. The web-tier of the site sits on three EC2 instances inside an Auto Scaling Group. The Auto Scaling group is configured to scale when CPU utilization of the instances is greater than 70%. The Auto Scaling group sits behind an Elastic Load Balancer, and your static content lives in S3 and is distributed globally by CloudFront. Your RDS database is an db.r3.8xlarge instance. CloudWatch metrics show that your RDS instance usually has around 2GB of memory free, and an average CPU utilization of 75%. Currently, it is taking your users in Japan and Australia approximately 3 - 5 seconds to load your website, and you have been asked to help reduce these load-times. How might you improve your page load times? (Choose 3)
Setup CloudFront with dynamic content support to enable the caching of re-usable content from the media rich website.
Change your Auto Scaling Group so that it will scale when CPU Utilization is only 50%, rather than 70%.
Use ElastiCache to cache the most commonly accessed DB queries.
Set up a clone of your production environment in the Asia Pacific region and configure latency based routing on Route53.
Upgrade the RDS instance to a higher memory instance.
(from acloudguru - practice Exam)
You are a consultant planning to deploy DynamoDB across three AZs. Your lead DBA is concerned about data consistency. Which of the following do you advise the lead DBA to do?
To ask the development team to implement a checksum algorithm to confirm that the data is consistent across all the AZs.
To ask the development team to code a Lambda function to check data consistency after each write.
To ask the development team to code for strongly consistent reads. As the consultant, you will advise the CTO of the increased cost.
To ask the development team to code to check for a successful completion code (200) at the completion of every write.
To ask the development team to code for Strongly Consistent Reads, as it will impact the read times slightly, but not the budget.
(from acloudguru - practice Exam)
You have three AWS accounts (A, B & C) which share data. In an attempt to maximize performance between the accounts, you deploy the instances owned by these three accounts in 'eu-west-1b'. During testing, you find inconsistent results in transfer latency between the instances. Transfer between accounts A and B is excellent, but transfers between accounts B and C, and C and A, are slower. What could be the problem ?
You have accidentally set up account C in "us-west-1b".
The names of the AZs are randomly applied, so "eu-west-1b" is not necessarily the same physical location for all three accounts.
The instances for Account C are on an overloaded Host. Stop all the Account C instances and then start them together so that they run an a new host.
Account C has been allocated to an older section of the Data Hall with slower networking.
You have incorrectly configured the cross-account authentication policies in Account C, adding latency to those instances.
(from acloudguru - practice Exam)
What are the four levels of AWS premium support?
Free, Bronze, Silver, and Gold
Basic, Developer, Business, and Enterprise
Basic, Startup, Business, and Enterprise
It's an IAAS platform, so there is no support.
(from acloudguru - practice Exam)
Your company likes the idea of storing files on AWS. However, low-latency service of the majority of files is important to customer service. Which Storage Gateway configuration would you use to achieve both of these ends? (Choose 2)
Gateway-Snapshot
Gateway-Snapshot
Gateway-Stored
File Gateways
Gateway-VTL
Gateway-Cached
(from acloudguru - practice Exam)
Which of the following strategies does AWS use to deliver the promised levels of DynamoDB performance? (Choose 2)
The Database is partitioned across a number of nodes.
AWS deploys Read Replicas of the database to balance the load.
DynamoDB instances can be configured with EBS-Optimised connections.
AWS deploy caching instances in front of the DynamoDB cluster.
Data is stored on Solid State Disks.
(from acloudguru - practice Exam)
Which of the following are valid S3 data encryption options? (Choose 4)
Open SSL.
SSE-KMS.
A client library such as Amazon S3 Encryption Client.
SSE-C.
Server Side Encryption (SSE)-S3.
(from acloudguru - practice Exam)
What is the maximum VisibilityTimeout of an SQS message in a FIFO queue?
1 day
1 hour
14 days
12 hours
(from acloudguru - practice Exam)
You have been monitoring a sensitive autoscaling group, and you expect it to scale-in as you enter a period of holiday downtime. The auto scaling group is distributed over three AZs ( AZ - A & -B have two instances each, and AZ -C has three instances). All instances have different CPU and Memory utilization, and all instances have been running for a different number of days. All instances come from different versions of a root AMI, and all instances have different numbers of sessions connected. Which instance will be the 1st to shut down?
The instance that has been running longest will terminate first.
The instance in AZ -C that has the least number of sessions will terminate first.
The instance in AZ -C that has been running the longest will terminate first.
The instance in AZ -C that has the oldest launch configuration will terminate first.
The Instance with the fewest current sessions will terminate first.
(from acloudguru - practice Exam)
Route53, the AWS implementation of DNS, supports a number of Routing policies. Which of the following are valid Policy types? (Choose 3)
Failover Routing Policy
Simple Routing Policy
Default Routing Policy
Load Balanced Routing Policy
Latency Routing Policy
(from acloudguru - practice Exam)
Your server logs are full of what appear to be application-layer attacks, so you deploy AWS Web Application Firewall. Which of the following conditions may you set when configuring AWS WAF? (Choose 3)
IP Match Conditions
Termination Conditions
SQL Rejection Match Conditions
Size Constraint Conditions
String Match Conditions
(from acloudguru - practice Exam)
Which of the following are not valid CloudFormation template sections?
Outputs
Options
Resources
Parameters
(from acloudguru - practice Exam)
How does AWS deliver high durability for DynamoDB?
AWS maintain a schedule of incremental backups and log shipping.
DynamoDB data is automatically replicated across multiple AZs.
DynamoDB supports user Snapshots to S3.
(from acloudguru - practice Exam)
When making use of ec2 instances on Dedicated Hosting, which of the following modes are you able to transition between by stopping the instance and starting it again? (Choose 2)
Default & Dedicated
Host & Dedicated.
Dedicated & Host
Dedicated & Default
Host & Default
(from acloudguru - practice Exam)
A client is concerned that someone other than approved administrators is trying to gain access to the Linux web app instances in their VPC. She asks what sort of network access logging can be added. Which of the following might you recommend? (Choose 2)
Set up a Flow Log for the group of instances and forward them to S3.
Use Event Log filters to trigger alerts that are forwarded to CloudWatch.
Set up a traffic logging rule on the network firewall and direct the log to CloudWatch or S3.
Set up a Flow Log for the group of instances and forward them to CloudWatch.
Make use of an OS-level logging tools such as iptables and log events to CloudWatch or S3.
(from acloudguru - practice Exam)
Which of the following are valid Route53 routing policies? (Choose 3)
Latency
Multitarget answer
Simple
Complex
Weighted
(from acloudguru - practice Exam)
You have been engaged as a consultant by a company that generates utility bills and publishes them online. PDF images are generated, then stored on a high-performance RDS instance. Customarily, invoices are viewed by customers once per month. Recently, the number of customers has increased threefold, and the wait-time necessary to view invoices has increased unacceptably. The CTO is unwilling to alter the codebase more than necessary this quarter, but needs to return performance to an acceptable level before the end-of-the-month print run. Which of the following solutions would you feel comfortable proposing to the CTO and GM? (Choose 2)
Move the metadata to a DynamoDB solution, permitting real-time scaling of Read IOPS to match demand.
Use CloudFront to accelerate presentation of the PDF images.
Create RDS Read-Replicas and additional Web/App instances across all the available AZs.
Evaluate the risks and benefits associated with an RDS instance upgrade.
Install an ElastiCache cluster in front of the RDS installation.
(from acloudguru - practice Exam)
At the monthly product meeting, one of the Product Owners proposes an idea to address an immediate shortcoming of the product system: storing a copy of the customer price schedule in the customer record in the database. You know that you can store large text or binary objects in DynamoDB. You give a tentative OK to do a Minimal Viable Product test, but stipulate that it must comply with the size limitation on the Attribute Name & Value. Which is the correct limitation?
The combined Value and Name combined must not exceed 500 KB.
The combined Value and Name combined must not exceed 400 KB.
The combined Value and Name combined must not exceed 255 KB.
The Name must not exceed 64 KB and the Value must not exceed 255 KB.
The Name must not exceed 64 KB and the Value must not exceed 400 KB.
(from acloudguru - practice Exam)
Which of the following database technologies are supported by RDS. (Choose 3)
DynamoDB
DB2
MariaDB
Aurora
Oracle
(from acloudguru - practice Exam)
The Customer Experience manager comes to see you about some odd behaviours with the ticketing system: messages presented to the support team are not arriving in the order in which they were generated. You know that this is due to the way that the underlying SQS standard queue service is being used to manage messages. Which of the following are correct explanations? (Choose 2)
If an agent abandons a message or takes a break before finishing with a message, it will be offered in the queue again. In order to ensure that no message is lost, a message will persist in the SQS queue until it is processed successfully.
The support staff are probably using the provided admin tools to amend the priority in the SQS queue based on their experience and insights about the issues.
SQS has been setup to prioritize messages in the queue based on keywords.
As the SQS service gets busy, some of the hosts will automatically swap from FIFO to LIFO to provide a better work load balance and clearance rate.
SQS uses multiple hosts, and each host holds only a portion of all the messages. When a staff member calls for their next message, the consumer process does not see all the hosts or all the messages. As such, messages are not necessarily delivered in the order in which they were generated.
(from acloudguru - practice Exam)
You are a solutions architect working for a construction company. Your company is migrating their production estate to AWS, and you are in the process of setting up access to the AWS console using Identity Access Management (IAM). You have created 15 users for your system administrators. What further steps do you need to take to enable your system administrators to get access to the AWS console in a secure fashion? (Choose 2)
Generate a password for each user and give these passwords to your system administrators.
Give the system administrators the secret access key and access key id, and tell them to use these credentials to log in to the AWS console.
Get the systems administrators to download the CLI and configure this on their laptop, using their user names and passwords.
Have each user set up multi factor authentication once they have logged-in to the console.
(from acloudguru - practice Exam)
You are a solutions architect at a large digital media company. The company has decided that they want to operate within the Japanese region, and they need a bucket called "testbucket" set up immediately for testing purposes. You log in to the AWS console and try to create this bucket in the Japanese region. However, you are told that the bucket name is already taken. What should you do to resolve this?
Change your region to Korea and then create the bucket "testbucket".
Raise a ticket with AWS and ask them to release the name "testbucket" to you.
Run a WHO IS request on the bucket name and get the registered owners email address. Contact the owner and ask if you can purchase the rights to the bucket.
Bucket names are global, not regional. This is a popular bucket name and is already taken. You must choose another bucket name.
(from acloudguru - practice Exam)
Which of the following features only relate to Spread Placement Groups?
The placement group can only have 7 running instances per Availability Zone
Instances must be deployed in a single Availability Zone
There is no charge for creating a placement group
The name of your placement group must be unique within your AWS Account
(from acloudguru - practice Exam)
You have created a Direct Connect Link from your on premise data center to your Amazon VPC. The link is now active and routes are being advertised from the on-premise data center. You can connect to EC2 instances from your data center; however, you cannot connect to your on premise servers from your EC2 instances. Which of the following solutions would remedy this issue? (Choose 2)
Enable route propagation on your Virtual Private Gateway (VPG).
Enable route propagation on your Customer Gateway (CGW).
Use an IPSEC VPN and add this route to the route table with the VPN being the target.
Configure a new route from the NAT to the on premise data center.
Edit the VPC subnet route table, adding a route back to the on-premise data center.
(from acloudguru - practice Exam)
You're building out a single-region application in us-west-2. However, disaster recovery is a strong consideration, and you need to build the application so that if us-west-2 becomes unavailable, you can fail-over to us-west-1. Your application relies exclusively on pre-built AMI's. In order to share those AMI's with the region you're using as a backup, which process would you follow?
Nothing: AMIs are specific to an account, and they can be used anywhere.
Create a new instance in us-west-1, making certain the instance in the failover region shares a security group with the instance in the default region.
Copy the AMI from us-west-2 to us-west-1 and launch as-is.
Copy the AMI from us-west-2, manually apply launch permissions, user-defined tags, and Amazon S3 bucket permissions of the default AMI to the new instance, and launch the instance.
(from acloudguru - practice Exam)
You work for a toy company that has a busy online store. As you are approaching Christmas, you find that your store is getting more and more traffic. You ensure that the web tier of your store is behind an Auto Scaling group. However, you notice that the web tier is frequently scaling, sometimes multiple times in an hour, only to scale back after peak usage. You need to keep Auto Scaling from scaling up and down so rapidly. Which of the following options would help you to achieve this?
Modify the Auto Scaling group cool-down timers & modify the Amazon CloudWatch alarm period that triggers your Auto Scaling scale down policy.
Configure Auto Scaling to terminate your newest instances first, then adjust your CloudWatch alarm.
Change your Auto Scaling policy so that it only scales at scheduled times.
Configure Auto Scaling to terminate your oldest instances first, then adjust your CloudWatch alarm.
(from acloudguru - practice Exam)
What is the maximum response time for a Business Level 'production down' Support Case?
1 Day
12 Hours
1 Hour
15 Minutes
(from acloudguru - practice Exam)
AWS provides a number of security related managed services. From the options below, select which AWS service is related to protecting your infrastructure from which security issue. (Choose 4)
AWS Shield protects from Distributed Denial of Service attacks
AWS Shield protects from SQL Injection attacks
AWS WAF protects from Cross Site Scripting attacks
Amazon Macie uses Machine Learning to protect sensitive data
AWS WAF blocks IP addresses based on rules
