Font size
WorksheetsAWS Architect Test 2
Total questions: 12
Worksheet time: 12mins
Your company currently has a set of EC2 Instances hosted in AWS. The states of these instances need to be monitored and each state needs to be changed when a metric breaches a threshold value. Which step could be helpful to fulfill this requirement? (SELECT TWO)
Use CloudWatch logs to store the state change of the instances.
Create an Amazon CloudWatch alarm that monitors an Amazon EC2 instance
Use SQS to trigger a record to be added to a DynamoDB table.
Use AWS Lambda to store a change record in a DynamoDB table.
You own a MySQL RDS instance in AWS Region us-east-1. The instance has a Multi-AZ instance in another availability zone for high availability. As business grows, there are more and more clients coming from Europe (eu-west-2) and most of the database workload is read-only. What is the proper way to reduce the load on the source RDS instance?
Create a snapshot of the instance and launch a new instance in eu-west-2.
Promote the Multi-AZ instance to be a Read Replica and move the instance to eu-west-2 region.
Configure a read-only Multi-AZ instance in eu-west-2 as Read Replicas cannot span across regions.
Create a Read Replica in the AWS Region eu-west-2.
Third-party sign-in (Federation) has been implemented in your web application to allow users who need access to AWS resources. Users have been successfully logging in using Google, Facebook, and other third-party credentials. Suddenly, their access to some AWS resources has been restricted. What is the most likely cause of the restricted use of AWS resources?
IAM policies for resources were changed, thereby restricting access to AWS resources
Federation protocols are used to authorize services and need to be updated
AWS changed the services allowed to be accessed via federated login
The identity providers no longer allow access to AWS services
A security audit discovers that one of your RDS MySQL instances is not encrypted. The instance has a Read Replica in the same AWS region which is also not encrypted. You need to fix this issue as soon as possible. What is the proper way to add encryption to the instance and its replica?
Copy a DB snapshot and encrypt the snapshot. Restore a new DB instance from the encrypted snapshot and add a Read Replica.
Encrypt the DB instance. Launch a new Read Replica and the replica is encrypted automatically.
Create a DB snapshot and encrypt the snapshot. Launch a new instance and its Read Replica from the snapshot.
Promote the Read Replica to be a standalone instance and encrypt it. Add a new Read Replica to the standalone instance.
Your recent security review revealed a large spike in attempted logins to your AWS account. With respect to sensitive data stored in encryption enabled S3, the data has not been encrypted and is susceptible to fraud if it was to be stolen. You’ve recommended AWS Key Management Service as a solution. Which of the following is true regarding the operation of KMS?
Only KMS generated keys can be used to encrypt or decrypt data
Data es encrypted at rest
KMS allows all users and roles to use the keys by default
Data is encrypted in transit
Your company has a set of EC2 Instances hosted in AWS. It is mandatory to prepare for disasters and come up with the necessary disaster recovery procedures. What would be helpful in mitigating the effects of a disaster for the EC2 Instances?
Place an ELB in front of the EC2 Instances
Use auto scaling to ensure that the minimun number of instances are always running
Use cloudfront in front of the EC2 Instances
Use AMIs to recreate the EC2 intances in another region
A company has a set of Hyper-V machines and VMware virtual machines. They are now planning to migrate these resources to the AWS Cloud. What should they use to move these resources to the AWS Cloud?
DB Migration Utility
AWS Server Migration Service
Use AWS Migration Tools
Use AWS Config Tools
A Singapore based large Architect firm is using Amazon S3 bucket to save all architecture drawings. This firm works globally multiple accounts are created within the Singapore region as well in other regions to access AWS resources. Users in all these accounts access the Amazon S3 bucket for architectural drawings. AWS Organisation is created for accounts in the Singapore region. Central IT Teams are managing access to S3 buckets using Service Control Policies with AWS Organisations.
SCP will block access to Amazon S3 bucket to all accounts within the Singapore region including root users of each account within AWS Organisation as well as access to users outside this region who have access to S3 bucket.
SCP will block access to Amazon S3 bucket to all accounts within the Singapore region including root users of each account within AWS Organisation not to users outside this region who have access to S3 bucket.
SCP will block access to Amazon S3 bucket to all accounts within the Singapore region excluding root users of each account within AWS Organisation as well as access to users outside this region who have access to S3 bucket.
SCP will block access to Amazon S3 bucket to all accounts within the Singapore region excluding root users of each account within AWS Organisation not to users outside this region who have access to S3 bucket.
A global content management company is using Amazon Aurora as a database for scaling millions of documents with high throughput. The Development Team has created a new version of the database which needs to be shared with TEST and PRODUCTION accounts within the company which will run their own OLAP queries. The company is using AWS Organisations to manage policies have consolidated billing across all AWS accounts. Which of the following can be done to share DB clusters with the TEST account?
Enable sharing for Master account of AWS organizations grant access to TEST account sharing DB cluster from its own account as well as DB shared by Production account.
Enable sharing for member accounts of AWS organizations grant access to the TEST account sharing DB cluster from its own account.
Enable sharing for Master member account of AWS organizations grant access TEST account sharing DB cluster from its own account as well as DB shared by Production account.
Enable sharing for Master account of AWS organizations grant access to TEST account sharing DB cluster from its own account.
A Financial firm is planning to build a highly resilient application with primary database servers at on-premise data centers while DB snapshots at Amazon S3 bucket. IT Team is looking for a cost-effective secure way of the initial transfer of large customer financial databases between on-premise servers to Amazon S3 bucket with no impact on client usage of these applications. Also, post this data transfer, the on-premise application will be fetching data from the database in Amazon S3 in case of a primary database fails.
Use Amazon S3 Transfer Acceleration for transferring data between the on-premise Amazon S3 bucket while using AWS Data Sync for accessing these S3 bucket data from the on-premise application.
Use AWS Data Sync for transferring data between the on-premise Amazon S3 bucket while using AWS Storage Gateway for accessing these S3 bucket data from the on-premise application.
Use AWS Snowball Edge for transferring data between the on-premise Amazon S3 bucket while using AWS Storage Gateway for accessing these S3 bucket data from the on-premise application.
Use AWS Transfer for transferring data between the on-premise Amazon S3 bucket while using AWS Data Sync for accessing these S3 bucket data from the on-premise application.
A company has an application that delivers objects from S3 to users. Of late, some users spread across the globe, have been complaining of slow response times. Which additional step would help in building a cost-effective solution and ensure that the users get an optimal response to objects from S3?
Use S3 Replication to replicate the objects to regions closest to the users.
Ensure S3 Transfer Acceleration is enabled to ensure that all users get the desired response times.
Place an ELB in front of S3 to distribute the load across S3.
Place the S3 bucket behind a CloudFront distribution.
A start-up firm has a corporate office at New York regional office in Washington Chicago. These offices are interconnected over Internet links. Recently they have migrated a few application servers to EC2 instance launched in AWS US-east-1 region. The Developer Team located at the corporate office requires secure access to these servers for initial testing performance checks before go-live of new application. Since the go-live date is approaching soon, the IT team is looking for quick connectivity to be established. As an AWS consultant which link option will you suggest for a cost effective quick way to establish secure connectivity from on-premise to servers launched in AWS?
Use AWS Direct Connect to establish IPSEC connectivity from On-premise to VGW.
Use Hardware VPN to establish IPSEC connectivity from On-premise to VGW.
Use Hardware VPN over AWS Direct Connect to establish IPSEC connectivity from On-premise to VGW.
Use Software VPN to establish IPSEC connectivity from On-premise to EC2 instance.
