WorksheetsSeguridad - Clase 9
Total questions: 12
Worksheet time: 16mins
A large company has multiple departments. Each department has its own AWS account. Each department has purchased Amazon EC2 Reserved Instances. Some departments do not use all the Reserved Instances that they purchased, and other departments need more Reserved Instances than they purchased. The company needs to manage the AWS accounts for all the departments so that the departments can share the Reserved Instances.
Which AWS service or tool should the company use to meet these requirements?
AWS Systems Manager
Cost Explorer
AWS Trusted Advisor
AWS Organizations
A company is launching an ecommerce application that must always be available. The application will run on Amazon EC2 instances continuously for the next 12 months.
What is the MOST cost-effective instance purchasing option that meets these requirements?
Spot Instances
Savings Plans
Dedicated Hosts
On-Demand Instances
Which documentation does AWS Artifact provide?
Amazon EC2 terms and conditions
AWS ISO certifications
A history of a company's AWS spending
A list of previous-generation Amazon EC2 instance types
What is the scope of a VPC within the AWS network?
A VPC can span all Availability Zones globally.
A VPC must span at least two subnets in each AWS Region.
A VPC must span at least two edge locations in each AWS Region.
A VPC can span all Availability Zones within an AWS Region.
Which AWS service will help protect applications running on AWS from DDoS attacks?
Amazon GuardDuty
AWS WAF
AWS Shield
Amazon Inspector
A company is implementing a new business application. The application runs on two Amazon EC2 instances and uses an Amazon S3 bucket for document storage. A solutions architect needs to ensure that the EC2 instances can access the S3 bucket.
What should the solutions architect do to meet this requirement?
Create an IAM role that grants access to the S3 bucket. Attach the role to the EC2 instances.
Create an IAM policy that grants access to the S3 bucket. Attach the policy to the EC2 instances.
Create an IAM group that grants access to the S3 bucket. Attach the group to the EC2 instances.
Create an IAM user that grants access to the S3 bucket. Attach the user account to the EC2 instances.
A company needs to review its AWS Cloud deployment to ensure that its Amazon S3 buckets do not have unauthorized configuration changes.
What should a solutions architect do to accomplish this goal?
Turn on AWS Config with the appropriate rules.
Turn on AWS Trusted Advisor with the appropriate checks.
Turn on Amazon Inspector with the appropriate assessment template.
Turn on Amazon S3 server access logging. Configure Amazon EventBridge (Amazon Cloud Watch Events).
A company hosts its multi-tier applications on AWS. For compliance, governance, auditing, and security, the company must track configuration changes on its AWS resources and record a history of API calls made to these resources.
What should a solutions architect do to meet these requirements?
Use AWS CloudTrail to track configuration changes and AWS Config to record API calls.
Use AWS Config to track configuration changes and AWS CloudTrail to record API calls.
Use AWS Config to track configuration changes and Amazon CloudWatch to record API calls.
Use AWS CloudTrail to track configuration changes and Amazon CloudWatch to record API calls.
A company is preparing to launch a public-facing web application in the AWS Cloud. The architecture consists of Amazon EC2 instances within a VPC behind an Elastic Load Balancer (ELB). A third-party service is used for the DNS. The company's solutions architect must recommend a solution to detect and protect against large-scale DDoS attacks.
Which solution meets these requirements?
Enable Amazon GuardDuty on the account.
Enable Amazon Inspector on the EC2 instances.
Enable AWS Shield and assign Amazon Route 53 to it.
Enable AWS Shield Advanced and assign the ELB to it.
A company runs a highly available image-processing application on Amazon EC2 instances in a single VPC. The EC2 instances run inside several subnets across multiple Availability Zones. The EC2 instances do not communicate with each other. However, the EC2 instances download images from Amazon S3 and upload images to Amazon S3 through a single NAT gateway. The company is concerned about data transfer charges.
What is the MOST cost-effective way for the company to avoid Regional data transfer charges?
Launch the NAT gateway in each Availability Zone.
Replace the NAT gateway with a NAT instance.
Deploy a gateway VPC endpoint for Amazon S3.
Provision an EC2 Dedicated Host to run the EC2 instances.
A solutions architect is developing a VPC architecture that includes multiple subnets. The architecture will host applications that use Amazon EC2 instances and Amazon RDS DB instances. The architecture consists of six subnets in two Availability Zones. Each Availability Zone includes a public subnet, a private subnet, and a dedicated subnet for databases. Only EC2 instances that run in the private subnets can have access to the RDS databases.
Which solution will meet these requirements?
Create a new route table that excludes the route to the public subnets' CIDR blocks. Associate the route table with the database subnets.
Create a security group that denies inbound traffic from the security group that is assigned to instances in the public subnets. Attach the security group to the DB instances.
Create a security group that allows inbound traffic from the security group that is assigned to instances in the private subnets. Attach the security group to the DB instances.
Create a new peering connection between the public subnets and the private subnets. Create a different peering connection between the private subnets and the database subnets.
A company has a website hosted on AWS. The website is behind an Application Load Balancer (ALB) that is configured to handle HTTP and HTTPS separately. The company wants to forward all requests to the website so that the requests will use HTTPS.
What should a solutions architect do to meet this requirement?
Update the ALB's network ACL to accept only HTTPS traffic.
Create a rule that replaces the HTTP in the URL with HTTPS.
Create a listener rule on the ALB to redirect HTTP traffic to HTTPS.
Replace the ALB with a Network Load Balancer configured to use Server Name Indication (SNI).
