WorksheetsAWS Assessment - EC2, IAM & S3
Total questions: 50
Worksheet time: 1hrs 15mins
Name
Class
Date
1.
Your application on an m5.large instance consistently shows 95% CPU during 9 AM-5 PM and 15% overnight. Last month's bill shows $150 for this instance. What's the MOST cost-effective solution?
a)
Upgrade to m5.xlarge for better performance
b)
Use two t3.medium instances with Auto Scaling
c)
Keep m5.large but purchase a 1-year Reserved Instance
d)
Use AWS Compute Savings Plans with scheduled scaling
2.
You launched an EC2 instance in a public subnet with an Internet Gateway, assigned an Elastic IP, and configured the security group to allow SSH (port 22) from 0.0.0.0/0. You still cannot SSH. What should you check FIRST?
a)
Verify the instance has a public DNS name
b)
Check if the Network ACL allows inbound traffic on port 22
c)
Confirm the SSH key pair is correct
d)
Check if the route table has a route to the Internet Gateway
3.
Your user data script fails to install Docker on an Ubuntu EC2 instance. Where should you look to debug this issue?
a)
EC2 instance metadata at http://169.254.169.254/
b)
/var/log/user-data.log
c)
/var/log/cloud-init-output.log
d)
AWS CloudWatch Logs under /aws/ec2/userdata
4.
You're running a stateful application on EC2 with session data stored locally. The instance needs to scale horizontally. What's the BEST approach to maintain session data?
a)
Use sticky sessions on the load balancer
b)
Store session data in instance store volumes
c)
Use ElastiCache or DynamoDB for session storage
d)
Enable EC2 Instance Store Persistence
5.
An application requires 20,000 IOPS with consistent low latency. Which storage solution should you choose?
a)
EBS General Purpose SSD (gp3)
b)
EBS Provisioned IOPS SSD (io2)
c)
Instance Store
d)
EFS with Max I/O performance mode
6.
Your Spot instance receives a 2-minute interruption notice. What should your application do to handle this gracefully?
a)
Immediately stop all processes and save state to S3
b)
Request a Spot instance hibernation
c)
Transfer the Elastic IP to a backup instance
d)
Save work to persistent storage and deregister from load balancer
7.
You need to share an AMI with another AWS account without making it public. What's the correct approach?
a)
Change AMI permissions to public and share the AMI ID
b)
Modify AMI permissions and add the specific AWS account ID
c)
Copy the AMI to the other account using aws ec2 copy-image
d)
Export the AMI to S3 and share the S3 bucket
8.
An instance in a cluster placement group fails. What happens to the placement group?
a)
The entire placement group is terminated
b)
The placement group continues to function with remaining instances
c)
The placement group becomes degraded and needs recreation
d)
AWS automatically replaces the failed instance in the same placement group
9.
You need to retrieve the public IP address of your EC2 instance from within the instance itself. Which command works?
a)
curl http://169.254.169.254/latest/meta-data/public-ipv4
b)
curl http://169.254.169.254/latest/user-data/public-ip
c)
aws ec2 describe-instances --instance-id i-xxxxx
d)
cat /etc/aws/instance-ip
10.
Your Auto Scaling group uses a launch template with instance type t3.medium. You want to add t3.large to the mix. What feature allows this?
a)
Launch Configuration Override
b)
Mixed Instances Policy
c)
Multiple Launch Templates
d)
Instance Type Fleet
11.
An EBS volume attached to a stopped instance becomes stuck in "detaching" state. What's the likely cause?
a)
The instance must be running to detach volumes
b)
The volume is a root volume
c)
Another operation is in progress on the volume
d)
The volume has snapshots in progress
12.
You need to run a script every time an EC2 instance starts, including after stop/start cycles. Where should you place this logic?
a)
EC2 User Data (it runs only at launch)
b)
Create a systemd service or cron @reboot job
c)
Store script in /etc/init.d/
d)
Use EC2 Run Command on instance start
13.
Your application requires 5 instances with the LOWEST latency between them. Which placement group type should you use?
a)
Cluster Placement Group
b)
Partition Placement Group
c)
Spread Placement Group
d)
Availability Zone Placement Group
14.
What happens to the data on an instance store volume when you stop and then start an instance?
a)
Data persists and is available when instance starts
b)
Data is lost permanently
c)
Data is automatically backed up to S3
d)
You cannot stop instances with instance store volumes
15.
You're migrating an instance from us-east-1a to us-west-2b. What's required?
a)
Stop instance, detach EBS, copy to new region, create instance
b)
Create AMI, copy AMI to target region, launch instance from AMI
c)
Use AWS Migration Hub to transfer the instance
d)
Take EBS snapshot, copy snapshot, launch from snapshot
16.
Five instances behind an ALB show healthy in target group but users report intermittent errors. CloudWatch shows 5% of requests return 503. What should you check?
a)
Security group rules on the ALB
b)
Connection draining settings
c)
Target group health check configuration (interval, timeout, thresholds)
d)
Auto Scaling group desired capacity
17.
You want to ensure your EC2 instances always launch with the latest security patches. What's the BEST approach?
a)
Use the latest AWS-provided AMI each time
b)
Run yum update in user data at launch
c)
Create a pipeline to regularly build updated AMIs
d)
Enable automatic OS updates on the instance
18.
An EC2 instance needs to access S3. What's the MOST secure way to provide credentials?
a)
Store AWS access keys in environment variables
b)
Attach an IAM role to the EC2 instance
c)
Use aws configure with IAM user credentials
d)
Store credentials in a config file with restricted permissions
19.
You have an IAM policy with both Allow and Deny for s3:GetObject on the same resource. What happens?
a)
Allow takes precedence because it's more permissive
b)
Deny takes precedence; explicit deny always wins
c)
The policy is invalid and returns an error
d)
The last statement in the policy takes precedence
20.
A developer needs temporary access to production for 4 hours. What's the BEST approach?
a)
Create a temporary IAM user and delete after 4 hours
b)
Share the production IAM user credentials temporarily
c)
Create an IAM role with time-based condition and MFA
d)
Add the user to production group temporarily
21.
What's the maximum duration for temporary credentials issued by AWS STS AssumeRole?
a)
1 hour
b)
12 hours
c)
24 hours
d)
36 hours
22.
An IAM policy uses the condition "aws:SecureTransport": "false". What does this enforce?
a)
Requires all requests to use HTTPS
b)
Denies requests that use HTTPS
c)
Allows only HTTP requests
d)
Denies requests that use HTTP
23.
You need to grant Account B access to resources in Account A. What's required in Account A?
a)
IAM user with cross-account permissions
b)
IAM role with a trust policy allowing Account B to assume it
c)
IAM group with external principals
d)
Resource-based policy with Account B principal
24.
A user has full S3 access via IAM policy but bucket policy explicitly denies them. Can they access the bucket?
a)
Yes, IAM policies override bucket policies
b)
No, explicit deny always takes precedence
c)
Only if they're the bucket owner
d)
Depends on which policy was created first
25.
What's the difference between IAM permission boundaries and regular IAM policies?
a)
Permission boundaries grant permissions; policies restrict them
b)
Permission boundaries set maximum permissions; policies grant within those limits
c)
They're the same thing with different names
d)
Permission boundaries only apply to roles, not users
26.
You want to enforce that all EC2 instances are tagged with "Owner" at creation. Which feature should you use?
a)
IAM policy with Condition on ec2:RunInstances requiring ec2:CreateTags
b)
AWS Config rule to check for tags
c)
Service Control Policy (SCP) with tag enforcement
d)
IAM policy denying ec2:RunInstances without RequestTag condition
27.
An IAM user can list S3 buckets but gets "Access Denied" when downloading objects. What's likely missing?
a)
s3:GetObject permission on the bucket
b)
s3:GetObject permission on the objects
c)
Both bucket-level and object-level permissions
d)
s3:ListBucket permission
28.
What happens when an IAM role's session expires?
a)
The role is deleted and must be recreated
b)
Temporary credentials stop working; new credentials must be obtained
c)
Credentials auto-renew for another session
d)
AWS automatically extends the session by 1 hour
29.
You want to prevent IAM users from creating access keys for themselves. Which action should you deny?
a)
iam:CreateUser
b)
iam:CreateAccessKey
c)
iam:GetAccessKey
d)
iam:GenerateCredentials
30.
An application in Account A needs to assume a role in Account B. What must be configured in Account B's role trust policy?
a)
Account A's IAM user ARN
b)
Account A's account ID as Principal
c)
Account A's root user credentials
d)
Account B's own account ID
31.
What's the purpose of IAM Access Analyzer?
a)
Analyzes CloudTrail logs for security threats
b)
Identifies resources shared with external entities
c)
Optimizes IAM policies for cost savings
d)
Monitors IAM user login patterns
32.
A policy grants s3:* on arn:aws:s3:::my-bucket/*. Can the user create new objects in the bucket?
a)
Yes, s3:* includes s3:PutObject
b)
No, they need s3:PutObject explicitly stated
c)
Only if they have s3:CreateBucket permission
d)
Yes, but only in the root of the bucket
33.
You need to rotate access keys for 50 IAM users. What's the BEST automated approach?
a)
Delete all keys and create new ones using AWS CLI
b)
Use IAM credential report to identify old keys, then use Lambda to rotate them
c)
Enable automatic key rotation in IAM settings
d)
Use AWS Secrets Manager to manage access keys
34.
You upload an object to S3 and immediately try to read it from a different region. What happens?
a)
Read fails; S3 is only eventually consistent
b)
Read succeeds; S3 offers read-after-write consistency
c)
Read succeeds only if versioning is enabled
d)
Read succeeds only if CRR is configured
35.
A bucket has versioning enabled. You delete an object without specifying a version ID. What happens?
a)
The object and all versions are permanently deleted
b)
A delete marker is created; previous versions remain
c)
Only the latest version is deleted
d)
Deletion fails; you must specify a version ID
36.
You're storing 10 million 50KB files. After 90 days, they're rarely accessed. What's the MOST cost-effective storage class transition?
a)
Standard → Standard-IA → Glacier
b)
Standard → Intelligent-Tiering
c)
Standard → One Zone-IA → Glacier
d)
Keep in Standard; storage cost is negligible
37.
Which S3 storage class has the HIGHEST availability SLA?
a)
S3 Standard (99.99%)
b)
S3 Standard-IA (99.9%)
c)
S3 One Zone-IA (99.5%)
d)
S3 Glacier (99.99%)
38.
Your bucket receives 5,500 PUT requests per second, all to keys starting with "log-YYYY-MM-DD". Performance is poor. What's the issue?
a)
S3 has a hard limit of 5,000 requests/second
b)
Sequential key names create hot partitions
c)
Bucket needs to be in multiple regions
d)
Objects are too small for efficient processing
39.
What's the minimum object size required before multipart upload provides benefits?
a)
5 MB
b)
100 MB
c)
1 GB
d)
5 GB
40.
You want to require encryption for all objects uploaded to a bucket. What's the MOST effective method?
a)
Enable default encryption on the bucket
b)
Use a bucket policy denying uploads without encryption header
c)
Both A and B for defense in depth
d)
Use IAM policies requiring encryption
41.
A pre-signed URL expires after how long by default if no expiration is specified?
a)
15 minutes
b)
1 hour
c)
24 hours
d)
7 days
42.
You need to analyze 500GB of CSV files in S3 without downloading them. Which service should you use?
a)
S3 Batch Operations
b)
AWS Glue
c)
S3 Select
d)
Amazon Athena
43.
Cross-Region Replication requires which S3 feature to be enabled?
a)
Server-side encryption
b)
Versioning
c)
Transfer Acceleration
d)
Lifecycle policies
44.
What happens to objects in a bucket when you disable versioning after it was previously enabled?
a)
All versions are immediately deleted
b)
Existing versions remain; new uploads don't create versions
c)
Versioning cannot be disabled once enabled
d)
Bucket must be emptied first to disable versioning
45.
You're hosting a static website on S3. Users report "403 Forbidden" errors. What's the MOST likely cause?
a)
Bucket doesn't have static website hosting enabled
b)
Objects don't have public read permissions
c)
CloudFront distribution isn't configured
d)
Website endpoint isn't configured in Route 53
46.
What's the difference between S3 Standard-IA and S3 One Zone-IA?
a)
Availability SLA (99.9% vs 99.5%)
b)
Number of Availability Zones (3+ vs 1)
c)
Retrieval time (instant vs minutes)
d)
Both A and B
47.
A lifecycle policy transitions objects to Glacier after 30 days. After 40 days, you need immediate access to an object. What happens?
a)
Object is available instantly; Glacier Instant Retrieval
b)
Object requires expedited retrieval (1-5 minutes)
c)
Object requires standard retrieval (3-5 hours)
d)
Object cannot be retrieved from Glacier
48.
You want to prevent accidental deletion of critical S3 objects. What should you enable?
a)
S3 Object Lock in compliance mode
b)
MFA Delete with versioning
c)
S3 Glacier Vault Lock
d)
Bucket policy denying s3:DeleteObject
49.
What's the maximum size of a single S3 object?
a)
5 GB
b)
5 TB
c)
50 TB
d)
No limit
50.
Your application uploads files with user-generated names like "file.txt". Multiple users upload files with the same name. How can you prevent overwrites?
a)
Enable versioning on the bucket
b)
Use unique prefixes for each user
c)
Generate unique file names (e.g., UUID)
d)
All of the above
100 %
