Ruskey Posted January 25, 2017 Report Share Posted January 25, 2017 Don’t find customers for your products, find products for your customers. McDonald's is turning Masala Dosa into a burger. McDonald's plans to recreate this classic Indian fast food in a new avatar -- the masala dosa burger. The Masala Dosa Brioche will look like a burger, except for the potato patty inside, which is supposed to evoke the flavours of a dosa's aloo masala. It will come in a brioche, a rich French bread, with the patty slathered with a molaga podi chutney mayo. It remains to be seen whether this very novel Indo-American fusion can win over dosa purists. Quote Link to comment Share on other sites More sharing options...
kingoftollywood Posted January 25, 2017 Report Share Posted January 25, 2017 US lo na india lo na? Quote Link to comment Share on other sites More sharing options...
Ruskey Posted January 25, 2017 Author Report Share Posted January 25, 2017 3 minutes ago, kingoftollywood said: US lo na india lo na? I am from U.K. It's available here... Quote Link to comment Share on other sites More sharing options...
tennisluvr Posted January 25, 2017 Report Share Posted January 25, 2017 16 minutes ago, Ruskey said: I am from U.K. It's available here... Monnati varaku pittsburgh annavu. Quote Link to comment Share on other sites More sharing options...
dakumangalsingh Posted January 25, 2017 Report Share Posted January 25, 2017 1 minute ago, tennisluvr said: Monnati varaku pittsburgh annavu. Baga followavtunnav ga Quote Link to comment Share on other sites More sharing options...
Ruskey Posted January 25, 2017 Author Report Share Posted January 25, 2017 16 minutes ago, tennisluvr said: Monnati varaku pittsburgh annavu. Yes uncle moved to U.K. On 20th Jan Quote Link to comment Share on other sites More sharing options...
katuri Posted January 25, 2017 Report Share Posted January 25, 2017 Trumps FAV SPOT MCD........................ Quote Link to comment Share on other sites More sharing options...
summer27 Posted January 25, 2017 Report Share Posted January 25, 2017 dosa, idly meeda kooda patent teesukuntaremo McD vallu Quote Link to comment Share on other sites More sharing options...
Ruskey Posted January 25, 2017 Author Report Share Posted January 25, 2017 17 minutes ago, katuri said: Trumps FAV SPOT MCD........................ Quote Link to comment Share on other sites More sharing options...
Ruskey Posted January 25, 2017 Author Report Share Posted January 25, 2017 Just now, summer27 said: dosa, idly meeda kooda patent teesukuntaremo McD vallu Quote Link to comment Share on other sites More sharing options...
bussuboy Posted January 25, 2017 Report Share Posted January 25, 2017 24 minutes ago, Ruskey said: Yes uncle moved to U.K. On 20th Jan Hello Rusky...pelli annavu....party annavu....all bussu? Now jumped to UK. 🤔😀😁😣😏😉 Quote Link to comment Share on other sites More sharing options...
Ruskey Posted January 25, 2017 Author Report Share Posted January 25, 2017 Just now, bussuboy said: Hello Rusky...pelli annavu....party annavu....all bussu? Now jumped to UK. 🤔😀😁😣😏😉 Yes uncle moved on 20th, WIPRO moved me here... Quote Link to comment Share on other sites More sharing options...
katuri Posted January 25, 2017 Report Share Posted January 25, 2017 AWS Certified SysOps Administrator – Associate Exam: AWS-SysOps Edition: 2.0 AWS-SysOps 1http://www.examarea.comhttp://www.fravo.com QUESTION: 1 You are currently hosting multiple applications in a VPC and have logged numerous port scans coming in from a specific IP address block. Your security team has requested that all access from the offending IP address block be denied tor the next 24 hours. Which of the following is the best method to quickly and temporarily deny access from the specified IP address block? A. Create an AD policy to modify Windows Firewall settings on all hosts in the VPC to deny access from the IP address block B. Modify the Network ACLs associated with all public subnets in the VPC to deny access from the IP address block C. Add a rule to all of the VPC 5 Security Groups to deny access from the IP address block D. Modify the Windows Firewall settings on all Amazon Machine Images (AMIs) that your organization uses in that VPC to deny access from the IP address block Answer: C Reference:http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html QUESTION: 2 When preparing for a compliance assessment of your system built inside of AWS. what are three best-practices for you to prepare for anaudit? Choose 3 answers A. Gather evidence of your IT operational controls B. Request and obtain applicable third-party audited AWS compliance reports and certifications C. Request and obtain a compliance and security tour of an AWS data center for a preassessment security review D. Request and obtain approval from AWS to perform relevant network scans and indepth penetration tests of your system's Instances and endpoints E. Schedule meetings with AWS's third-party auditors to provide evidence of AWS compliance that maps to your control objectives Answer: B, C, D QUESTION: 3 AWS-SysOps 2http://www.examarea.comhttp://www.fravo.com You have started a new job and are reviewing your company's infrastructure on AWS You notice one web application where they have an Elastic Load Balancer (&B) in front of web instances in an Auto Scaling Group When you check the metrics for the ELB in CloudWatch you see four healthy instances In Availability Zone (AZ) A and zero in AZ B There are zero unhealthy instances. What do you need to fix to balance the instances across AZs? A. Set the ELB to only be attached to another AZ B. Make sure Auto Scaling is configured to launch in both AZs C. Make sure your AMI is available in both AZs D. Make sure the maximum size of the Auto Scaling Group is greater than 4 Answer: C QUESTION: 4 You have been asked to leverage Amazon VPC BC2 and SOS to implement an application that submits and receives millions of messages per second to a message queue. You want to ensure your application has sufficient bandwidth between your EC2 instances and SQS Which option will provide (he most scalable solution for communicating between the application and SOS? A. Ensure the application instances are properly configured with an Elastic Load Balancer B. Ensure the application instances are launched in private subnets with the EBSoptimized option enabled C. Ensure the application instances are launched in public subnets with the associatepublic- IP- address=true option enabled D. Launch application instances in private subnets with an Auto Scaling group and Auto Scaling triggers configured to watch the SOS queue size Answer: C Reference:http://www.cardinalpath.com/autoscaling-your-website-with-amazon-web-servicespart- 2/ QUESTION: 5 You have identified network throughput as a bottleneck on your ml small EC2 instance when uploading data Into Amazon S3 In the same region.How do you remedy this situation? AWS-SysOps 3http://www.examarea.comhttp://www.fravo.com A. Add an additional ENI B. Change to a larger Instance C. Use DirectConnect between EC2 and S3 D. Use EBS PIOPS on the local volume Answer: B Reference:https://media.amazonwebservices.com/AWS_Amazon_EMR_Best_Practices.pdf QUESTION: 6 When attached to an Amazon VPC which two components provide connectivity with external networks? Choose 2 answers A. Elastic IPS (EIP) B. NAT Gateway (NAT) C. Internet Gateway {IGW) D. Virtual Private Gateway (VGW) Answer: C, D QUESTION: 7 Your application currently leverages AWS Auto Scaling to grow and shrink as load Increases' decreases and has been performing well Your marketing team expects a steady ramp up in traffic to follow an upcoming campaign that will result in a 20x growth in traffic over 4 weeks Your forecast for the approximate number of Amazon EC2 instances necessary to meet the peak demand is 175.What should you do to avoid potential service disruptions during the ramp up in traffic? A. Ensure that you have pre-allocated 175 Elastic IP addresses so that each server will be able to obtain one as it launches B. Check the service limits in Trusted Advisor and adjust as necessary so the forecasted count remains within limits. C. Change your Auto Scaling configuration to set a desired capacity of 175 prior to the launch of the marketing campaign D. Pre-warm your Elastic Load Balancer to match the requests per second anticipated during peak demand prior to the marketing campaign AWS-SysOps 4http://www.examarea.comhttp://www.fravo.com Answer: C QUESTION: 8 You have an Auto Scaling group associated with an Elastic Load Balancer (ELB). You have noticed that instances launched via the Auto Scaling group are being marked unhealthy due to an ELB health check, but these unhealthy instances are not being terminated What do you need to do to ensure trial instances marked unhealthy by the ELB will be terminated and replaced? A. Change the thresholds set on the Auto Scaling group health check B. Add an Elastic Load Balancing health check to your Auto Scaling group C. Increase the value for the Health check interval set on the Elastic Load Balancer D. Change the health check set on the Elastic Load Balancer to use TCP rather than HTTP checks Answer: B Reference:http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-add-elbhealthcheck. html Explanation: Add an Elastic Load Balancing Health Check to your Auto Scaling GroupBy default, an Auto Scaling group periodically reviews the results of EC2 instance status to determine the health state of each instance. However, if you have associated your Auto Scaling group with an Elastic Load Balancing load balancer, you can choose to use the Elastic Load Balancing health check. In this case, Auto Scaling determines the health status of your instances by checking the results of both the EC2 instance status check and the Elastic Load Balancing instance health check.For information about EC2 instance status checks, see Monitor Instances With Status Checks in the Amazon EC2 User Guide for Linux Instances. For information about Elastic Load Balancing health checks, see Health Check in the Elastic Load Balancing Developer Guide. This topic shows you how to add an Elastic Load Balancing health check to your Auto Scaling group, assuming that you have created a load balancer and have registered the load balancer with your Auto Scaling group. If you have not registered the load balancer with your Auto Scaling group, see Set Up a Scaled and Load-Balanced Application.Auto Scaling marks an instance unhealthy if the calls to the Amazon EC2 action DescribeInstanceStatus return any state other than running, the system status shows impaired, or the calls to Elastic Load Balancing action DescribeInstanceHealth returns OutOfService in the instance state field. If there are multiple load balancers associated with your Auto Scaling group, Auto Scaling checks the health state of your EC2 instances by making health check calls to AWS-SysOps 5http://www.examarea.comhttp://www.fravo.com each load balancer. For each call, if the Elastic Load Balancing action returns any state other than InService, the instance is marked as unhealthy. After Auto Scaling marks an instance as unhealthy, it remains in that state, even if subsequent calls from other load balancers return an InService state for the same instance. QUESTION: 9 Which two AWS services provide out-of-the-box user configurable automatic backupas- a-service and backup rotation options? Choose 2 answers A. Amazon S3 B. Amazon RDS C. Amazon EBS D. Amazon Red shift Answer: B, D QUESTION: 10 An organization has configured a VPC with an Internet Gateway (IGW). pairs of public and private subnets (each with one subnet per Availability Zone), and an Elastic Load Balancer (ELB) configured to use the public subnets The application s web tier leverages the ELB. Auto Scaling and a mum-AZ RDS database instance The organization would like to eliminate any potential single points ft failure in this design. What step should you take to achieve this organization's objective? A. Nothing, there are no single points of failure in this architecture. B. Create and attach a second IGW to provide redundant internet connectivity. C. Create and configure a second Elastic Load Balancer to provide a redundant load balancer. D. Create a second multi-AZ RDS instance in another Availability Zone and configurereplication to provide a redundant database. Answer: C QUESTION: 11 Which of the following are characteristics of Amazon VPC subnets? Choose 2 answers A. Each subnet maps to a single Availability Zone B. A CIDR block mask of /25 is the smallest range supported AWS-SysOps 6http://www.examarea.comhttp://www.fravo.com C. Instances in a private subnet can communicate with the internet only if they have an Elastic IP. D. By default, all subnets can route between each other, whether they are private or public E. V Each subnet spans at least 2 Availability zones to provide a high-availability environment Answer: C, E QUESTION: 12 You are creating an Auto Scaling group whose Instances need to insert a custom metric into CloudWatch. Which method would be the best way to authenticate your CloudWatch PUT request? A. Create an IAM role with the Put MetricData permission and modify the Auto Scaling launch configuration to launch instances in that role B. Create an IAM user with the PutMetricData permission and modify the Auto Scaling launch configuration to inject the userscredentials into the instance User Data C. Modify the appropriate Cloud Watch metric policies to allow the Put MetricData permission to instances from the Auto Scaling group D. Create an IAM user with the PutMetricData permission and put the credentials in a private repository and have applications on the server pull the credentials as needed Answer: D QUESTION: 13 When an EC2 instance that is backed by an S3-based AMI Is terminated, what happens to the data on me root volume? A. Data is automatically saved as an E8S volume. B. Data is automatically saved as an ESS snapshot. C. Data is automatically deleted. D. Data is unavailable until the instance is restarted. Answer: D Reference:http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ComponentsAMIs.html AWS-SysOps 7http://www.examarea.comhttp://www.fravo.com QUESTION: 14 You have a web application leveraging an Elastic Load Balancer (ELB) In front of the web servers deployed using an Auto Scaling Group Your database is running on Relational Database Service (RDS) The application serves out technical articles and responses to them in general there are more views of an article than there are responses to the article. On occasion, an article on the site becomes extremely popular resulting in significant traffic Increases that causes the site to go down. What could you do to help alleviate the pressure on the infrastructure while maintaining availability during these events? Choose 3 answers A. Leverage CloudFront for the delivery of the articles. B. Add RDS read-replicas for the read traffic going to your relational database C. Leverage ElastiCache for caching the most frequently used data. D. Use SOS to queue up the requests for the technical posts and deliver them out of the queue. E. Use Route53 health checks to fail over to an S3 bucket for an error page. Answer: A, C, E QUESTION: 15 The majority of your Infrastructure is on premises and you have a small footprint on AWS Your company has decided to roll out a new application that is heavily dependent on low latency connectivity to LOAP for authentication Your security policy requires minimal changes to the company's existing application user management processes. What option would you implement to successfully launch this application1? A. Create a second, independent LOAP server in AWS for your application to use for authentication B. Establish a VPN connection so your applications can authenticate against your existing on- premises LDAP servers C. Establish a VPN connection between your data center and AWS create a LDAP replica on AWS and configure your application to use the LDAP replica for authentication D. Create a second LDAP domain on AWS establish a VPN connection to establish a trust relationship between your new and existing domains and use the new domain for authentication Answer: D Reference: AWS-SysOps 8http://www.examarea.comhttp://www.fravo.comhttp://msdn.microsoft.com/en-us/library/azure/jj156090.aspx QUESTION: 16 You need to design a VPC for a web-application consisting of an Elastic Load Balancer (ELB). a fleet of web/application servers, and an RDS database The entire Infrastructure must be distributed over 2 availability zones. Which VPC configuration works while assuring the database is not available from the Internet? A. One public subnet for ELB one public subnet for the web-servers, and one private subnet for the database B. One public subnet for ELB two private subnets for the web-servers, two private subnets for RDS C. Two public subnets for ELB two private subnets for the web-servers and two private subnets for RDS D. Two public subnets for ELB two public subnets for the web-servers, and two public subnets for RDS Answer: C QUESTION: 17 An application that you are managing has EC2 instances & Dynamo OB tables deployed to several AWS Regions In order to monitor the performance of the application globally, you would like to see two graphs 1) Avg CPU Utilization across all EC2 instances and 2) Number of Throttled Requests for all DynamoDB tables. How can you accomplish this? A. Tag your resources with the application name, and select the tag name as the dimension in the Cloudwatch Management console to view the respective graphs B. Use the Cloud Watch CLI tools to pull the respective metrics from each regional endpoint Aggregate the data offline & store it for graphing in CloudWatch. C. Add SNMP traps to each instance and DynamoDB table Leverage a central monitoring server to capture data from each instance and table Put the aggregate data into Cloud Watch for graphing. D. Add a CloudWatch agent to each instance and attach one to each DynamoDB table. When configuring the agent set the appropriate application name & view the graphs in CloudWatch. Answer: A AWS-SysOps 9http://www.examarea.comhttp://www.fravo.com QUESTION: 18 When assessing an organization s use of AWS API access credentials which of the following three credentials should be evaluated? Choose 3 answers A. Key pairs B. Console passwords C. Access keys D. Signing certificates E. Security Group memberships Answer: A, C, D Reference:http://media.amazonwebservices.com/AWS_Operational_Checklists.pdf QUESTION: 19 You have a Linux EC2 web server instance running inside a VPC The instance is In a public subnet and has an EIP associated with it so you can connect to It over the Internet via HTTP or SSH The instance was also fully accessible when you last logged in via SSH. and was also serving web requests on port 80. Now you are not able to SSH into the host nor does it respond to web requests on port 80 that were working fine last time you checked You have double-checked that all networking configuration parameters (security groups route tables. IGW'EIP. NACLs etc) are properly configured {and you haven’t made any changes to those anyway since you were last able to reach the Instance). You look at the EC2 console and notice that system status check shows "impaired." Which should be your next step in troubleshooting and attempting to get the instance back to a healthy state so that you can log in again? A. Stop and start the instance so that it will be able to be redeployed on a healthy host system that most likely will fix the "impaired" system status B. Reboot your instance so that the operating system will have a chance to boot in a clean healthy state that most likely will fix the 'impaired" system status C. Add another dynamic private IP address to me instance and try to connect via mat new path, since the networking stack of the OS may be locked up causing the “impaired” system status. D. Add another Elastic Network Interface to the instance and try to connect via that new path since the networking stack of the OS may be locked up causing the "impaired" system status E. un-map and then re-map the EIP to the instance, since the IGWVNAT gateway may not be working properly, causing the "impaired" system status AWS-SysOps 10http://www.examarea.comhttp://www.fravo.com Answer: A QUESTION: 20 What is a placement group? A. A collection of Auto Scaling groups in the same Region B. Feature that enables EC2 instances to interact with each other via nigh bandwidth, low latency connections C. A collection of Elastic Load Balancers in the same Region or Availability Zone D. A collection of authorized Cloud Front edge locations for a distribution Answer: C Reference:http://aws.amazon.com/ec2/faqs/ QUESTION: 21 Your entire AWS infrastructure lives inside of one Amazon VPC You have an Infrastructure monitoring application running on an Amazon instance in Availability Zone (AZ) A of the region, and another application instance running in AZ B. The monitoring application needs to make use of ICMP ping to confirm network reachability of the instance hosting the application. Can you configure the security groups for these instances to only allow the ICMP ping to pass from the monitoringinstance to the application instance and nothing else'' If so how? A. No Two instances in two different AZ's can't talk directly to each other via ICMP ping as that protocol is not allowed across subnet (iebroadcast) boundaries B. Yes Both the monitoring instance and the application instance have to be a part of the same security group, and that security group needs to allow inbound ICMP C. Yes, The security group for the monitoring instance needs to allow outbound ICMP and the application instance's security group needs to allow Inbound ICMP D. Yes, Both the monitoring instance's security group and the application instance's security group need to allow both inbound and outbound ICMP ping packets since ICMP is not a connection- oriented protocol Answer: A QUESTION: 22 You have two Elastic Compute Cloud (EC2) instances inside a Virtual Private Cloud AWS-SysOps 11http://www.examarea.comhttp://www.fravo.com (VPC) in the same Availability Zone (AZ) but in different subnets.One instance is running a database and the other instance an application that will interface with the database. You want to confirm that they can talk to each other for your application to work properly. Which two things do we need to confirm in the VPC settings so that these EC2 instances can communicate inside the VPC? Choose 2 answers A. A network ACL that allows communication between the two subnets. B. Both instances are the same instance class and using the same Key-pair. C. That the default route is set to a NAT instance or internet Gateway (IGW) for them to communicate. D. Security groups are set to allow the application host to talk to the database on the right port/protocol. Answer: A, C QUESTION: 23 Which services allow the customer to retain full administrative privileges of the underlying EC2 instances? Choose 2 answers A. Amazon Elastic Map Reduce B. Elastic Load Balancing C. AWS Elastic Beanstalk D. I" Amazon Elasticache E. Amazon Relational Database service Answer: B, C QUESTION: 24 You have a web-style application with a stateless but CPU and memory-intensive web tier running on a cc2 8xlarge EC2 instance inside of a VPC The instance when under load is having problems returning requests within the SLA as defined by your business The application maintains its state in a DynamoDB table, but the data tier is properly provisioned and responses are consistently fast. How can you best resolve the issue of the application responses not meeting your SLA? A. Add another cc2 8xlarge application instance, and put both behind an Elastic Load Balancer B. Move the cc2 8xlarge to the same Availability Zone as the DynamoDB table C. Cache the database responses in ElastiCache for more rapid access AWS-SysOps 12http://www.examarea.comhttp://www.fravo.com D. Move the database from DynamoDB to RDS MySQL in scale-out read-replica configuration Answer: B Reference:http://aws.amazon.com/elasticmapreduce/faqs/ QUESTION: 25 You are managing a legacy application Inside VPC with hard coded IP addresses in its configuration. Which two mechanisms will allow the application to failover to new instances without the need for reconfiguration? Choose 2 answers A. Create an ELB to reroute traffic to a failover instance B. Create a secondary ENI that can be moved to a failover instance C. Use Route53 health checks to fail traffic over to a failover instance D. Assign a secondary private IP address to the primary ENIO that can De moved to a failover instance Answer: A, C QUESTION: 26 You are designing a system that has a Bastion host. This component needs to be highly available without human intervention. Which of the following approaches would you select? A. Run the bastion on two instances one in each AZ B. Run the bastion on an active Instance in one AZ and have an AMI ready to boot up in the event of failure C. Configure the bastion instance in an Auto Scaling group Specify the Auto Scaling group to include multiple AZs but have a min-size of 1 and max-size of 1 D. Configure an ELB in front of the bastion instance Answer: C QUESTION: 27 Which of the following statements about this S3 bucket policy is true? AWS-SysOps 13http://www.examarea.comhttp://www.fravo.com A. Denies the server with the IP address 192 168 100 0 full access to the "mybucket" bucket B. Denies the server with the IP address 192 168 100 188 full access to the "mybucket" bucket C. Grants all the servers within the 192 168 100 0/24 subnet full access to the "mybucket" bucket D. Grants all the servers within the 192 168 100 188/32 subnet full access to the "mybucket" bucket Answer: D AWS-SysOps 14http://www.examarea.comhttp://www.fravo.com QUESTION: 28 Which of the following requires a custom CloudWatch metric to monitor? A. Data transfer of an EC2 instance B. Disk usage activity of an EC2 instance C. Memory Utilization of an EC2 instance D. CPU Utilization of an EC2mstance Answer: B Reference:http://aws.amazon.com/cloudwatch/ QUESTION: 29 You run a web application where web servers on EC2 Instances are In an Auto Scaling group Monitoring over the last 6 months shows that 6 web servers are necessary to handle the minimum load During the day up to 12 servers are needed Five to six days per year, the number of web servers required might go up to 15. What would you recommend to minimize costs while being able to provide hill availability? A. 6 Reserved instances (heavy utilization). 6 Reserved instances {medium utilization), rest covered by On-Demand instances B. 6 Reserved instances (heavy utilization). 6 On-Demand instances, rest covered by Spot Instances C. 6 Reserved instances (heavy utilization) 6 Spot instances, rest covered by On- Demand instances D. 6 Reserved instances (heavy utilization) 6 Reserved instances (medium utilization) rest covered by Spot instances Answer: C QUESTION: 30 You have been asked to propose a multi-region deployment of a web-facing application where a controlled portion of your traffic is being processed by an alternate region. Which configuration would achieve that goal? A. Route53 record sets with weighted routing policy B. Route53 record sets with latency based routing policy AWS-SysOps 15http://www.examarea.comhttp://www.fravo.com C. Auto Scaling with scheduled scaling actions set D. Elastic Load Balancing with health checks enabled Answer: D Reference:http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/Terminology andKeyConcepts.html QUESTION: 31 You have set up Individual AWS accounts for each project. You have been asked to make sure your AWS Infrastructure costs do not exceed the budget set per project for each month. Which of the following approaches can help ensure that you do not exceed the budget each month? A. Consolidate your accounts so you have a single bill for all accounts and projects B. Set up auto scaling with CloudWatch alarms using SNS to notify you when you are running too many Instances in a given account C. Set up CloudWatch billing alerts for all AWS resources used by each project, with a notification occurring when the amount for each resource tagged to a particular project matches the budget allocated to the project. D. Set up CloudWatch billing alerts for all AWS resources used by each account, with email notifications when it hits 50%. 80% and 90% of its budgeted monthly spend Answer: B QUESTION: 32 When creation of an EBS snapshot Is initiated but not completed the EBS volume? A. Cannot De detached or attached to an EC2 instance until me snapshot completes B. Can be used in read-only mode while me snapshot is in progress C. Can be used while me snapshot Is in progress D. Cannot be used until the snapshot completes Answer: C Reference:http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-copy-snapshot.html AWS-SysOps 16http://www.examarea.comhttp://www.fravo.com QUESTION: 33 You are using ElastiCache Memcached to store session state and cache database queries in your infrastructure You notice in Cloud Watch that Evictions and GetMisses are Doth very high. What two actions could you take to rectify this? Choose 2 answers A. Increase the number of nodes in your cluster B. Tweak the max-item-size parameter C. Shrink the number of nodes in your cluster D. Increase the size of the nodes in the duster Answer: B, D QUESTION: 34 You are running a database on an EC2 instance, with the data stored on Elastic Block Store (EBS) for persistence At times throughout the day, you are seeing large variance in the response times of the database queries Looking into the instance with the isolate command you see a lot of wait time on the disk volume that the database's data is stored on.What two ways can you improve the performance of the database's storage while maintaining the current persistence of the data? Choose 2 answers A. Move to an SSD backed instance B. Move the database to an EBS-Optimized Instance C. T Use Provisioned IOPs EBS D. Use the ephemeral storage on an m2 4xiarge Instance Instead Answer: A, B QUESTION: 35 Your EC2-Based Multi-tier application includes a monitoring instance that periodically makes application -level read only requests of various application components and if any of those fail more than three times 30 seconds calls CloudWatch lo fire an alarm, and the alarm notifies your operations team by email and SMS of a possible application health problem. However, you also need to watch the watcher -the monitoring instance itself - and be notified if it becomes unhealthy. Which of the following Is a simple way to achieve that goal? A. Run another monitoring instance that pings the monitoring instance and fires a could watch alarm mat notifies your operations teamshould the primary monitoring instance AWS-SysOps 17http://www.examarea.comhttp://www.fravo.com become unhealthy. B. Set a Cloud Watch alarm based on EC2 system and instance status checks and have the alarm notify your operations team of anydetected problem with the monitoring instance. C. Set a Cloud Watch alarm based on the CPU utilization of the monitoring instance and nave the alarm notify your operations team if C r the CPU usage exceeds 50% few more than one minute: then have your monitoring application go into a CPU-bound loop should itDetect any application problems. D. Have the monitoring instances post messages to an SOS queue and then dequeue those messages on another instance should D c- the queue cease to have new messages, the second instance should first terminate the original monitoring instance start anotherbackup monitoring instance and assume (he role of the previous monitoring instance and beginning adding messages to the SOSqueue. Answer: C QUESTION: 36 You have decided to change the Instance type for instances running In your application tier that are using Auto Scaling. In which area below would you change the instance type definition? A. Auto Scaling launch configuration B. Auto Scaling group C. Auto Scaling policy D. Auto Scaling tags Answer: B Reference:http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/WhatIsAutoScaling.ht ml QUESTION: 37 You are attempting to connect to an instance in Amazon VPC without success You have already verified that the VPC has an Internet Gateway (IGW) the instance has an associated Elastic IP (EIP) and correct security group rules are in place. Which VPC component should you evaluate next? A. The configuration of a MAT instance AWS-SysOps 18http://www.examarea.comhttp://www.fravo.com B. The configuration of the Routing Table C. The configuration of the internet Gateway (IGW) D. The configuration of SRC'DST checking Answer: C Reference:http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/UserScenari osForVPC.html QUESTION: 38 You are tasked with the migration of a highly trafficked Node JS application to AWS In order to comply with organizational standards Chef recipes must be used to configure the application servers that host this application and to support application lifecycle events. Which deployment option meets these requirements while minimizing administrative burden? A. Create a new stack within Opsworks add the appropriate layers to the stack and deploy the application B. Create a new application within Elastic Beanstalk and deploy this application to a new environment C. Launch a Mode JS server from a community AMI and manually deploy the application to the launched EC2 instance D. Launch and configure Chef Server on an EC2 instance and leverage the AWS CLI to launch application servers and configure those instances using Chef. Answer: B Reference:http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.deployment.html QUESTION: 39 You have been asked to automate many routine systems administrator backup and recovery activities Your current plan is to leverage AWS-managed solutions as much as possible and automate the rest with the AWS CU and scripts. Which task would be best accomplished with a script? A. Creating daily EBS snapshots with a monthly rotation of snapshots B. Creating daily ROS snapshots with a monthly rotation of snapshots C. Automatically detect and stop unused or underutilized EC2 instances AWS-SysOps 19http://www.examarea.comhttp://www.fravo.com D. Automatically add Auto Scaled EC2 instances to an Amazon Elastic Load Balancer Answer: B QUESTION: 40 Your organization's security policy requires that all privileged users either use frequently rotated passwords or one-time access credentials in addition to username/password. Which two of the following options would allow an organization to enforce this policy for AWS users? Choose 2 answers A. Configure multi-factor authentication for privileged 1AM users B. Create 1AM users for privileged accounts C. Implement identity federation between your organization's Identity provider leveraging the 1AM Security Token Service D. Enable the 1AM single-use password policy option for privileged users Answer: B, D QUESTION: 41 What are characteristics of Amazon S3? Choose 2 answers A. Objects are directly accessible via a URL B. S3 should be used to host a relational database C. S3 allows you to store objects or virtually unlimited size D. S3 allows you to store virtually unlimited amounts of data E. S3 offers Provisioned IOPS Answer: B, C QUESTION: 42 You receive a frantic call from a new DBA who accidentally dropped a table containing all your customers. Which Amazon RDS feature will allow you to reliably restore your database to within 5 minutes of when the mistake was made? A. Multi-AZ RDS B. RDS snapshots C. RDS read replicas AWS-SysOps 20http://www.examarea.comhttp://www.fravo.com D. RDS automated backup Answer: B Reference:http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.BackingUpAnd RestoringAmazonRDSInstances.html QUESTION: 43 A media company produces new video files on-premises every day with a total size of around 100GBS after compression All files have a size of 1 -2 GB and need to be uploaded to Amazon S3 every night in a fixed time window between 3am and 5am Current upload takes almost 3 hours, although less than half of the available bandwidth is used.What step(s) would ensure that the file uploads are able to complete in the allotted time window? A. Increase your network bandwidth to provide faster throughput to S3 B. Upload the files in parallel to S3 C. Pack all files into a single archive, upload it to S3, then extract the files in AWS D. Use AWS Import/Export to transfer the video files Answer: D Reference:http://aws.amazon.com/importexport/faqs/ QUESTION: 44 You are running a web-application on AWS consisting of the following components an Elastic Load Balancer (ELB) an Auto-Scaling Group of EC2 instances running Linux/PHP/Apache, and Relational DataBase Service (RDS) MySQL. Which security measures fall into AWS's responsibility? A. Protect the EC2 instances against unsolicited access by enforcing the principle of least- privilege access B. Protect against IP spoofing or packet sniffing C. Assure all communication between EC2 instances and ELB is encrypted D. Install latest security patches on ELB. RDS and EC2 instances Answer: A AWS-SysOps 21http://www.examarea.comhttp://www.fravo.com QUESTION: 45 You use S3 to store critical data for your company Several users within your group currently have lull permissions to your S3 buckets You need to come up with a solution mat does not impact your users and also protect against the accidental deletion of objects. Which two options will address this issue? Choose 2 answers A. Enable versioning on your S3 Buckets B. Configure your S3 Buckets with MFA delete C. Create a Bucket policy and only allow read only permissions to all users at the bucket level D. Enable object life cycle policies and configure the data older than 3 months to be archived in Glacier Answer: B, C QUESTION: 46 An organization's security policy requires multiple copies of all critical data to be replicated across at least a primary and backup data center. The organization has decided to store some critical data on Amazon S3. Which option should you implement to ensure this requirement is met? A. Use the S3 copy API to replicate data between two S3 buckets in different regions B. You do not need to implement anything since S3 data is automatically replicated between regions C. Use the S3 copy API to replicate data between two S3 buckets in different facilities within an AWS Region D. You do not need to implement anything since S3 data is automatically replicated between multiple facilities within an AWS Region Answer: C QUESTION: 47 You are tasked with setting up a cluster of EC2 Instances for a NoSOL database The database requires random read 10 disk performance up to a 100.000 IOPS at 4KB block side per node Which of the following EC2 instances will perform the best for this workload? AWS-SysOps 22http://www.examarea.comhttp://www.fravo.com A. A High-Memory Quadruple Extra Large (m2 4xlarge) with EBS-Optimized set to true and a PIOPs EBS volume B. A Cluster Compute Eight Extra Large (cc2 8xlarge) using instance storage C. High I/O Quadruple Extra Large (hil 4xiarge) using instance storage D. A Cluster GPU Quadruple Extra Large (cg1 4xlarge) using four separate 4000 PIOPS EBS volumes in a RAID 0 configuration Answer: B Reference:http://aws.amazon.com/ec2/instance-types/ QUESTION: 48 When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral store volumes? A. Data will be deleted and win no longer be accessible B. Data Is automatically saved in an EBS volume. C. Data Is automatically saved as an E8S snapshot D. Data is unavailable until the instance is restarted Answer: D QUESTION: 49 Your team Is excited about theuse of AWS because now they have access to programmable Infrastructure" You have been asked to manage your AWS infrastructure In a manner similar to the way you might manage application code You want to be able to deploy exact copies of different versions of your infrastructure, stage changes into different environments, revert back to previous versions, and identify what versions are running at any particular time (development test QA. production). Which approach addresses this requirement? A. Use cost allocation reports and AWS Opsworks to deploy and manage your infrastructure. B. Use AWS CloudWatch metrics and alerts along with resource tagging to deploy and manage your infrastructure. C. Use AWS Beanstalk and a version control system like GIT to deploy and manage your infrastructure. D. Use AWS CloudFormation and a version control system like GIT to deploy and manage your infrastructure. AWS-SysOps 23http://www.examarea.comhttp://www.fravo.com Answer: A Reference:http://aws.amazon.com/opsworks/faqs/ QUESTION: 50 You have a server with a 5O0GB Amazon EBS data volume. The volume is 80% full. You need to back up the volume at regular intervals and be able to re-create the volume in a new Availability Zone in the shortest time possible. All applications using the volume can be paused for a period of a few minutes with no discernible user impact. Which of the following backup methods will best fulfill your requirements? A. Take periodic snapshots of the EBS volume B. Use a third party Incremental backup application to back up to Amazon Glacier C. Periodically back up all data to a single compressed archive and archive to Amazon S3 using a parallelized multi-part upload D. Create another EBS volume in the second Availability Zone attach it to the Amazon EC2 instance, and use a disk manager to mirror me two disks Answer: A Reference:http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html QUESTION: 51 Your company Is moving towards tracking web page users with a small tracking Image loaded on each page Currently you are serving this image out of US-East, but are starting to get concerned about the time It takes to load the image for users on the west coast. What are the two best ways to speed up serving this image? Choose 2 answers A. Use Route 53's Latency Based Routing and serve the image out of US-West-2 as well as US- East-1 B. Serve the image out through CloudFront C. Serve the image out of S3 so that it isn't being served oft of your web application tier D. Use EBS PIOPs to serve the image faster out of your EC2 instances Answer: A, B AWS-SysOps 24http://www.examarea.comhttp://www.fravo.com QUESTION: 52 If you want to launch Amazon Elastic Compute Cloud (EC2) Instances and assign each Instance a predetermined private IP address you should: A. Assign a group or sequential Elastic IP address to the instances B. Launch the instances in a Placement Group C. Launch the instances in the Amazon virtual Private Cloud (VPC). D. Use standard EC2 instances since each instance gets a private Domain Name Service (DNS) already E. Launch the Instance from a private Amazon Machine image (Mil) Answer: C Reference:http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html QUESTION: 53 A customer has a web application that uses cookie Based sessions to track logged in users It Is deployed on AWS using ELB and Auto Scaling The customer observes that when load increases. Auto Scaling launches new Instances but the load on the easting Instances does not decrease, causing all existing users to have a sluggish experience. Which two answer choices independently describe a behavior that could be the cause of the sluggish user experience? Choose 2 answers A. ELB's normal behavior sends requests from the same user to the same backend instance B. ELB's behavior when sticky sessions are enabled causes ELB to send requests in the same session to the same backend instance C. A faulty browser is not honoring the TTL of the ELB DNS name. D. The web application uses long polling such as comet or websockets. Thereby keeping a connection open to a web server tor a long time E. The web application uses long polling such as comet or websockets. Thereby keeping a connection open to a web server for a long time. Answer: B, D QUESTION: 54 What would happen to an RDS (Relational Database Service) multi-Availability Zone deployment of the primary OB instance fails? AWS-SysOps 25http://www.examarea.comhttp://www.fravo.com A. The IP of the primary DB instance is switched to the standby OB instance B. The RDS (Relational Database Service) DB instance reboots C. A new DB instance is created in the standby availability zone D. The canonical name record (CNAME) is changed from primary to standby Answer: A QUESTION: 55 How can the domain's zone apex for example "myzoneapexdomain com" be pointed towards an Elastic Load Balancer? A. By using an AAAA record B. By using an A record C. By using an Amazon Route 53 CNAME record D. By using an Amazon Route 53 Alias record Answer: C Reference:http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-setschoosing- alias- non-alias.html QUESTION: 56 An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords. How can the organization achieve this? A. The organization should create a separate login ID but give the IAM users the same alias so that each one can login with their alias B. The organization should create each user in a separate region so that they have their own URL to login C. It is not possible to have the same login ID for multiple IAM users of the same account D. The organization should create various groups and add each user with the same login ID to different groups. The user can login with their own group ID Answer: C AWS-SysOps 26http://www.examarea.comhttp://www.fravo.com Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. Whenever the organization is creating an IAM user, there should be a unique ID for each user. It is not possible to have the same login ID for multiple users. The names of users,groups, roles, instance profiles must be alphanumeric, including the following common characters: plus (+., equal (=., comma (,., period (.., at (@., and dash (-.. QUESTION: 57 A user is planning to evaluate AWS for their internal use. The user does not want to incur any charge on his account during the evaluation. Which of the below mentioned AWS services would incur a charge if used? A. AWS S3 with 1 GB of storage B. AWS micro instance running 24 hours daily C. AWS ELB running 24 hours a day D. AWS PIOPS volume of 10 GB size Answer: D Explanation: AWS is introducing a free usage tier for one year to help the new AWS customers get started in Cloud. The free tier can be used for anything that the user wants to run in the Cloud. AWS offers a handful of AWS services as a part of this which includes 750 hours of free micro instances and 750 hours of ELB. It includes the AWS S3 of 5 GB and AWS EBS general purpose volume upto 30 GB. PIOPS is not part of free usage tier. QUESTION: 58 A user has developed an application which is required to send the data to a NoSQL database. The user wants to decouple the data sending such that the application keeps processing and sending data but does not wait for an acknowledgement of DB. Which of the below mentioned applications helps in this scenario? A. AWS Simple Notification Service B. AWS Simple Workflow C. AWS Simple Queue Service D. AWS Simple Query Service Answer: C AWS-SysOps 27http://www.examarea.comhttp://www.fravo.com Explanation: Amazon Simple Queue Service (SQS. is a fast, reliable, scalable, and fully managed message queuing service. SQS provides a simple and cost-effective way to decouple the components of an application. In this case, the user can use AWS SQS to send messages which are received from an application and sent to DB. The application can continue processing data without waiting for any acknowledgement from DB. The user can use SQS to transmit any volume of data without losing messages or requiring other services to always be available. QUESTION: 59 An organization has created 50 IAM users. The organization has introduced a new policy which will change the access of an IAM user. How can the organization implement this effectively so that there is no need to apply the policy at the individual user level? A. Use the IAM groups and add users as per their role to different groups and apply policy to group B. The user can create a policy and apply it to multiple users in a single go with the AWS CLI C. Add each user to the IAM role as per their organization role to achieve effective policy setup D. Use the IAM role and implement access at the role level Answer: A Explanation: With AWS IAM, a group is a collection of IAM users. A group allows the user to specify permissions for a collection of users, which can make it easier to manage the permissions for those users. A group helps an organization manage access in a better way; instead of applying at the individual level, the organization can apply at the group level which is applicable to all the users who are a part of that group. QUESTION: 60 A user is planning to use AWS Cloud formation for his automatic deployment requirements. Which of the below mentioned components are required as a part of the template? A. Parameters B. Outputs C. Template version AWS-SysOps 28http://www.examarea.comhttp://www.fravo.com D. Resources Answer: D Explanation: AWS Cloud formation is an application management tool which provides application modelling, deployment, configuration, management and related activities. The template is a JSON-format, text-based file that describes all the AWS resources required to deploy and run an application. It can have option fields, such as Template Parameters, Output, Data tables, and Template file format version. The only mandatory value is Resource. The user can define the AWS services which will be used/ created by this template inside the Resource section QUESTION: 61 A user has recently started using EC2. The user launched one EC2 instance in the default subnet in EC2-VPC Which of the below mentioned options is not attached or available with the EC2 instance when it is launched? A. Public IP address B. Internet gateway C. Elastic IP D. Private IP address Answer: C Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to a user’s AWS account. A subnet is a range of IP addresses in the VPC. The user can launch the AWS resources into a subnet. There are two supported platforms into which a user can launch instances: EC2-Classic and EC2-VPC (default subnet.. A default VPC has all the benefits of EC2-VPC and the ease of use of EC2- Classic. Each instance that the user launches into a default subnet has a private IP address and a public IP address. These instances can communicate with the internet through an internet gateway. An internet gateway enables the EC2 instances to connect to the internet through the Amazon EC2 network edge. QUESTION: 62 A user has launched an EC2 instance. The user is planning to setup the CloudWatch alarm.Which of the below mentioned actions is not supported by the CloudWatch alarm? AWS-SysOps 29http://www.examarea.comhttp://www.fravo.com A. Notify the Auto Scaling launch config to scale up B. Send an SMS using SNS C. Notify the Auto Scaling group to scale down D. Stop the EC2 instance Answer: B Explanation: A user can create a CloudWatch alarm that takes various actions when the alarm changes state. An alarm watches a single metric over the time period that the user has specified, and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The actions could be sending a notification to an Amazon Simple Notification Service topic (SMS, Email, and HTTP end point.,notifying the Auto Scaling policy or changing the state of the instance to Stop/Terminate. QUESTION: 63 A user is trying to delete an Auto Scaling group from CLI. Which of the below mentioned steps are to be performed by the user? A. Terminate the instances with the ec2-terminate-instance command B. Terminate the Auto Scaling instances with the as-terminate-instance command C. Set the minimum size and desired capacity to 0 D. There is no need to change the capacity. Run the as-delete-group command and it will reset all values to 0 Answer: C Explanation: If the user wants to delete the Auto Scaling group, the user should manually set the values of the minimum and desired capacity to 0. Otherwise Auto Scaling will not allow for the deletion of the group from CLI. While trying from the AWS console, the user need not set the values to 0 as the Auto Scaling console will automatically do so. QUESTION: 64 An organization is planning to create 5 different AWS accounts considering various security requirements. The organization wants to use a single payee account by using the consolidated billing option. Which of the below mentioned statements is true with respect to the above information? AWS-SysOps 30http://www.examarea.comhttp://www.fravo.com A. Master (Payee. account will get only the total bill and cannot see the cost incurred by each account B. Master (Payee. account can view only the AWS billing details of the linked accounts C. It is not recommended to use consolidated billing since the payee account will have access to the linked accounts D. Each AWS account needs to create an AWS billing policy to provide permission to the payee account Answer: B Explanation: AWS consolidated billing enables the organization to consolidate payments for multiple Amazon Web Services (AWS. accounts within a single organization by making a single paying account. Consolidated billing enables the organization to see a combined view of the AWS charges incurred by each account as well as obtain a detailed cost report for each of the individual AWS accounts associated with the paying account. The payee account will not have any other access than billing data of linked accounts. QUESTION: 65 A user has created a web application with Auto Scaling. The user is regularly monitoring the application and he observed that the traffic is highest on Thursday and Friday between 8 AM to 6 PM. What is the best solution to handle scaling in this case? A. Add a new instance manually by 8 AM Thursday and terminate the same by 6 PM Friday B. Schedule Auto Scaling to scale up by 8 AM Thursday and scale down after 6 PM on Friday C. Schedule a policy which may scale up every day at 8 AM and scales down by 6 PM D. Configure a batch process to add a instance by 8 AM and remove it by Friday 6 PM Answer: B Explanation: Auto Scaling based on a schedule allows the user to scale the application in response to predictable load changes. In this case the load increases by Thursday and decreases by Friday. Thus, the user can setup the scaling activity based on the predictable traffic patterns of the web application using Auto Scaling scale by Schedule. AWS-SysOps 31http://www.examarea.comhttp://www.fravo.com QUESTION: 66 A user has setup a CloudWatch alarm on an EC2 action when the CPU utilization is above 75%. The alarm sends a notification to SNS on the alarm state. If the user wants to simulate the alarm action how can he achieve this? A. Run activities on the CPU such that its utilization reaches above 75% B. From the AWS console change the state to ‘Alarm’ C. The user can set the alarm state to ‘Alarm’ using CLI D. Run the SNS action manually Answer: C Explanation: Amazon CloudWatch alarms watch a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods.The user can test an alarm by setting it to any state using the SetAlarmState API (mon-set-alarm-state command.. This temporary state change lasts only until the next alarm comparison occurs. QUESTION: 67 A user has setup a billing alarm using CloudWatch for $200. The usage of AWS exceeded $200 after some days. The user wants to increase the limit from $200 to $400? What should the user do? A. Create a new alarm of $400 and link it with the first alarm B. It is not possible to modify the alarm once it has crossed the usage limit C. Update the alarm to set the limit at $400 instead of $200 D. Create a new alarm for the additional $200 amount Answer: C Explanation: AWS CloudWatch supports enabling the billing alarm on the total AWS charges. The estimated charges are calculated and sent several times daily to CloudWatch in the form of metric data. This data will be stored for 14 days. This data also includes the estimated charges for every service in AWS used by the user, as well as the estimated overall AWS charges. If the user wants to increase the limit, the user can modify the alarm and specify a new threshold. QUESTION: 68 AWS-SysOps 32http://www.examarea.comhttp://www.fravo.com A sys admin has created the below mentioned policy and applied to an S3 object named aws.jpg. The aws.jpg is inside a bucket named cloudacademy. What does this policy define? "Statement": [{ "Sid": "Stmt1388811069831", "Effect": "Allow", "Principal": { "AWS": "*"}, "Action": [ "s3:GetObjectAcl", "s3:ListBucket", "s3:GetObject"], "Resource": [ "arn:aws:s3:::cloudacademy/*.jpg"] }] A. It is not possible to define a policy at the object level B. It will make all the objects of the bucket cloudacademy as public C. It will make the bucket cloudacademy as public D. the aws.jpg object as public Answer: A Explanation: A system admin can grant permission to the S3 objects or buckets to any user or make objects public using the bucket policy and user policy. Both use the JSON-based access policy language. Generally if the user is defining the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be defined at the bucket level which allows the objects as well as the bucket to be public with a single policy applied to that bucket. It cannot be applied at the object level. QUESTION: 69 A user is trying to save some cost on the AWS services. Which of the below mentioned options will not help him save cost? A. Delete the unutilized EBS volumes once the instance is terminated B. Delete the AutoScaling launch configuration after the instances are terminated C. Release the elastic IP if not required once the instance is terminated D. Delete the AWS ELB after the instances are terminated Answer: B Explanation: AWS bills the user on a as pay as you go model. AWS will charge the user once the AWS resource is allocated. Even though the user is not using the resource, AWS will charge if it is in service or allocated. Thus, it is advised that once the user’s work is AWS-SysOps 33http://www.examarea.comhttp://www.fravo.com completed he should: Terminate the EC2 instance Delete the EBS volumes Release the unutilized Elastic IPs Delete ELB The AutoScaling launch configuration does not cost the user. Thus, it will not make any difference to the cost whether it is deleted or not. QUESTION: 70 A user is trying to aggregate all the CloudWatch metric data of the last 1 week. Which of the below mentioned statistics is not available for the user as a part of data aggregation? A. Aggregate B. Sum C. Sample data D. Average Answer: A Explanation: Amazon CloudWatch is basically a metrics repository. Either the user can send the custom data or an AWS product can put metrics into the repository, and the user can retrieve the statistics based on those metrics. The statistics are metric data aggregations over specified periods of time. Aggregations are made using the namespace, metric name, dimensions, and the data point unit of measure, within the time period that is specified by the user. CloudWatch supports Sum, Min, Max, Sample Data and Average statistics aggregation. QUESTION: 71 An organization is planning to use AWS for their production roll out. The organization wants to implement automation for deployment such that it will automatically create a LAMP stack, download the latest PHP installable from S3 and setup the ELB. Which of the below mentioned AWS services meets the quirement for making an orderly deployment of the software? A. AWS Elastic Beanstalk B. AWS Cloudfront C. AWS Cloudformation D. AWS DevOps Answer: C AWS-SysOps 34http://www.examarea.comhttp://www.fravo.com Explanation: AWS Cloudformation is an application management tool which provides application modelling, deployment, configuration, management and related activities. Cloudformation provides an easy way to create and delete the collection of related AWS resources and provision them in an orderly way. AWS CloudFormation automates and simplifies the task of repeatedly and predictably creating groups of related resources that power the user’s applications. AWS Cloudfront is a CDN; Elastic Beanstalk does quite a few of the required tasks. However, it is a PAAS which uses a ready AMI. AWS Elastic Beanstalk provides an environment to easily develop and run applications in the cloud. QUESTION: 72 A user has created a subnet with VPC and launched an EC2 instance in that subnet with only default settings.Which of the below mentioned options is ready to use on the EC2 instance as soon as it is launched? A. Elastic IP B. Private IP C. Public IP D. I nternet gateway Answer: B Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to a user’s AWS account. A subnet is a range of IP addresses in the VPC. The user can launch the AWS resources into a subnet. There are two supported platforms into which a user can launch instances: EC2-Classic and EC2-VPC. When the user launches an instance which is not a part of the non-default subnet, it will only have a private IP assigned to it. The instances part of a subnet can communicate with each other but cannot communicate over the internet or to the AWS services, such as RDS / S3. QUESTION: 73 An organization is setting up programmatic billing access for their AWS account. Which of the below mentioned services is not required or enabled when the organization wants to use programmatic access? A. Programmatic access B. AWS bucket to hold the billing report C. AWS billing alerts D. Monthly Billing report AWS-SysOps 35http://www.examarea.comhttp://www.fravo.com Answer: C Explanation: AWS provides an option to have programmatic access to billing. Programmatic Billing Access leverages the existing Amazon Simple Storage Service (Amazon S3. APIs. Thus, the user can build applications that reference his billing data from a CSV (comma-separated value. file stored in an Amazon S3 bucket. To enable programmatic access, the user has to first enable the monthly billing report. Then the user needs to provide an AWS bucket name where the billing CSV will be uploaded. The user should also enable the Programmatic access option. QUESTION: 74 A user has configured the Auto Scaling group with the minimum capacity as 3 and the maximum capacity as 5. When the user configures the AS group, how many instances will Auto Scaling launch? A. 3 B. 0 C. 5 D. 2 Answer: C Explanation: When the user configures the launch configuration and the Auto Scaling group, the Auto Scaling group will start instances by launching the minimum number (or the desired number, if specified. of EC2 instances. If there are no other scaling conditions attached to the Auto Scaling group, it will maintain the minimum number of running instances at all times. QUESTION: 75 An admin is planning to monitor the ELB. Which of the below mentioned services does not help the admin capture the monitoring information about the ELB activity? A. ELB Access logs B. ELB health check C. CloudWatch metrics D. ELB API calls with CloudTrail AWS-SysOps 36http://www.examarea.comhttp://www.fravo.com Answer: B Explanation: The admin can capture information about Elastic Load Balancer using either: CloudWatch Metrics ELB Logs files which are stored in the S3 bucket CloudTrail with API calls which can notify the user as well generate logs for each API calls The health check is internally performed by ELB and does not help the admin get the ELB activity. QUESTION: 76 A user is planning to use AWS Cloudformation. Which of the below mentioned functionalities does not help him to correctly understand Cloudfromation? A. Cloudformation follows the DevOps model for the creation of Dev & Test B. AWS Cloudfromation does not charge the user for its service but only charges for the AWS resources created with it C. Cloudformation works with a wide variety of AWS services, such as EC2, EBS, VPC, IAM, S3,RDS,ELB, etc D. CloudFormation provides a set of application bootstrapping scripts which enables the user to install Software Answer: A Explanation: AWS Cloudformation is an application management tool which provides application modelling, deployment, configuration, management and related activities. It supports a wide variety of AWS services, such as EC2, EBS, AS, ELB, RDS, VPC, etc. It also provides application bootstrapping scripts which enable the user to install software packages or create folders. It is free of the cost and only charges the user for the services created with it. The only challenge is that it does not follow any model, such as DevOps; instead customers can define templates and use them to provision and manage the AWS resources in an orderly way. QUESTION: 77 A user has launched 10 instances from the same AMI ID using Auto Scaling. The user is trying to see the average CPU utilization across all instances of the last 2 weeks under the CloudWatch console. How can the user achieve this? A. View the Auto Scaling CPU metrics B. Aggregate the data over the instance AMI ID AWS-SysOps 37http://www.examarea.comhttp://www.fravo.com C. The user has to use the CloudWatchanalyser to find the average data across instances D. It is not possible to see the average CPU utilization of the same AMI ID since the instance ID is different Answer: B Explanation: Amazon CloudWatch is basically a metrics repository. Either the user can send the custom data or an AWS product can put metrics into the repository, and the user can retrieve the statistics based on those metrics. The statistics are metric data aggregations over specified periods of time. Aggregations are made using the namespace, metric name, dimensions, and the data point unit of measure, within the time period that is specified by the user. To aggregate the data across instances launched with AMI, the user should select the AMI ID under EC2 metrics and select the aggregate average to view the data. QUESTION: 78 A user is trying to understand AWS SNS. To which of the below mentioned end points is SNS unable to send a notification? A. Email JSON B. HTTP C. AWS SQS D. AWS SES Answer: D Explanation: Amazon Simple Notification Service (Amazon SNS. is a fast, flexible, and fully managed push messaging service. Amazon SNS can deliver notifications by SMS text message or email to the Amazon Simple Queue Service (SQS. queues or to any HTTP endpoint. The user can select one the following transports as part of the subscription requests: “HTTP”, “HTTPS”,”Email”, “Email- JSON”, “SQS”, “and SMS”. QUESTION: 79 A user has configured an Auto Scaling group with ELB. The user has enabled detailed CloudWatch monitoring on Auto Scaling. Which of the below mentioned statements will help the user understand the functionality better? A. It is not possible to setup detailed monitoring for Auto Scaling AWS-SysOps 38http://www.examarea.comhttp://www.fravo.com B. In this case, Auto Scaling will send data every minute and will charge the user extra C. Detailed monitoring will send data every minute without additional charges D. Auto Scaling sends data every minute only and does not charge the user Answer: B Explanation: CloudWatch is used to monitor AWS as well as the custom services. It provides either basic or detailed monitoring for the supported AWS products. In basic monitoring, a service sends data points to CloudWatch every five minutes, while in detailed monitoring a service sends data points to CloudWatch every minute. Auto Scaling includes 7 metrics and 1 dimension, and sends data to CloudWatch every 5 minutes by default. The user can enable detailed monitoring for Auto Scaling, which sends data to CloudWatch every minute. However, this will have some extra-costs. QUESTION: 80 A system admin is planning to setup event notifications on RDS. Which of the below mentioned services will help the admin setup notifications? A. AWS SES B. AWS Cloudtrail C. AWS Cloudwatch D. AWS SNS Answer: D Explanation: Amazon RDS uses the Amazon Simple Notification Service to provide a notification when an Amazon RDS event occurs. These notifications can be in any notification form supported by Amazon SNS for an AWS region, such as an email, a text message or a call to an HTTP endpoint QUESTION: 81 You are building an online store on AWS that uses SQS to process your customer orders. Your backend system needs those messages in the same sequence the customer orders have been put in. How can you achieve that? A. It is not possible to do this with SQS B. You can use sequencing information on each message C. You can do this with SQS but you also need to use SWF AWS-SysOps 39http://www.examarea.comhttp://www.fravo.com D. Messages will arrive in the same order by default Answer: B Explanation: Amazon SQS is engineered to always be available and deliver messages. One of the resulting tradeoffs is that SQSdoes not guarantee first in, first out delivery of messages. For many distributed applications, each message can stand on its own, and as long as all messages are delivered, the order is not important. If your system requires that order be preserved, you can place sequencing information in each message, so that you can reorder the messages when the queue returns them. QUESTION: 82 An organization wants to move to Cloud. They are looking for a secure encrypted database storage option. Which of the below mentioned AWS functionalities helps them to achieve this? A. AWS MFA with EBS B. AWS EBS encryption C. Multi-tier encryption with Redshift D. AWS S3 server side storage Answer: B Explanation: AWS EBS supports encryption of the volume while creating new volumes. It also supports creating volumes from existing snapshots provided the snapshots are created from encrypted volumes. The data at rest, the I/O as well as all the snapshots of EBS will be encrypted. The encryption occurs on the servers that host the EC2 instances, providing encryption of data as it moves between the EC2 instances and EBS storage. EBS encryption is based on the AES-256 cryptographic algorithm, which is the industry standard QUESTION: 83 A user wants to disable connection draining on an existing ELB. Which of the below mentioned statements helps the user disable connection draining on the ELB? A. The user can only disable connection draining from CLI B. It is not possible to disable the connection draining feature once enabled C. The user can disable the connection draining feature from EC2 -> ELB console or AWS-SysOps 40http://www.examarea.comhttp://www.fravo.com from CLI D. The user needs to stop all instances before disabling connection draining Answer: C Explanation: The Elastic Load Balancer connection draining feature causes the load balancer to stop sending new requests to the back-end instances when the instances are deregistering or become unhealthy, while ensuring that inflight requests continue to be served. The user can enable or disable connection draining from the AWS EC2 console -> ELB or using CLI. QUESTION: 84 A user has a refrigerator plant. The user is measuring the temperature of the plant every 15 minutes. If the user wants to send the data to CloudWatch to view the data visually, which of the below mentioned statements is true with respect to the information given above? A. The user needs to use AWS CLI or API to upload the data B. The user can use the AWS Import Export facility to import data to CloudWatch C. The user will upload data from the AWS console D. The user cannot upload data to CloudWatch since it is not an AWS service metric Answer: A Explanation: AWS CloudWatch supports the custom metrics. The user can always capture the custom data and upload the data to CloudWatch using CLI or APIs. While sending the data the user has to include the metric name, namespace and timezone as part of the request. QUESTION: 85 A system admin is managing buckets, objects and folders with AWS S3. Which of the below mentioned statements is true and should be taken in consideration by the sysadmin? A. The folders support only ACL B. Both the object and bucket can have an Access Policy but folder cannot have policy C. Folders can have a policy D. Both the object and bucket can have ACL but folders cannot have ACL AWS-SysOps 41http://www.examarea.comhttp://www.fravo.com Answer: A Explanation: A sysadmin can grant permission to the S3 objects or the buckets to any user or make objects public using the bucket policy and user policy. Both use the JSON-based access policy language. Generally if user is defining the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be defined at the bucket level which allows the objects as well as the bucket to be public with a single policy applied to that bucket. It cannot be applied at the object level. The folders are similar to objects with no content. Thus, folders can have only ACL and cannot have a policy. QUESTION: 86 A user has created an ELB with three instances. How many security groups will ELB create by default? A. 3 B. 5 C. 2 D. 1 Answer: C Explanation: Elastic Load Balancing provides a special Amazon EC2 source security group that the user can use to ensure that back-end EC2 instances receive traffic only from Elastic Load Balancing. This feature needs two security groups: the source security group and a security group that defines the ingress rules for the back-end instances. To ensure that traffic only flows between the load balancer and the back-end instances, the user can add or modify a rule to the back-end security group which can limit the ingress traffic. Thus, it can come only from the source security group provided by Elastic load Balancing. QUESTION: 87 An organization has created 50 IAM users. The organization wants that each user can change their password but cannot change their access keys. How can the organization achieve this? A. The organization has to create a special password policy and attach it to each user B. The root account owner has to use CLI which forces each IAM user to change their AWS-SysOps 42http://www.examarea.comhttp://www.fravo.com password on first login C. By default each IAM user can modify their passwords D. The root account owner can set the policy from the IAM console under the password policy screen Answer: D Explanation: With AWS IAM, organizations can use the AWS Management Console to display, create, change or delete a password policy. As a part of managing the password policy, the user can enable all users to manage their own passwords. If the user has selected the option which allows the IAM users to modify their password, he does not need to set a separate policy for the users. This option in the AWS console allows changing only the password. QUESTION: 88 A user has created a photo editing software and hosted it on EC2. The software accepts requests from the user about the photo format and resolution and sends a message to S3 to enhance the picture accordingly.Which of the below mentioned AWS services will help make a scalable software with the AWS infrastructure in this scenario? A. AWS Glacier B. AWS Elastic Transcoder C. AWS Simple Notification Service D. AWS Simple Queue Service Answer: D Explanation: Amazon Simple Queue Service (SQS. is a fast, reliable, scalable, and fully managed message queuing service. SQS provides a simple and cost-effective way to decouple the components of an application. The user can configure SQS, which will decouple the call between the EC2 application and S3. Thus, the application does not keep waiting for S3 to provide the data. QUESTION: 89 An application is generating a log file every 5 minutes. The log file is not critical but may be required only for verification in case of some major issue. The file should be accessible over the internet whenever required. Which of the below mentioned options is a best possible storage solution for it? AWS-SysOps 43http://www.examarea.comhttp://www.fravo.com A. AWS S3 B. AWS Glacier C. AWS RDS D. AWS RRS Answer: D Explanation: Amazon S3 stores objects according to their storage class. There are three major storage classes: Standard, Reduced Redundancy Storage and Glacier. Standard is for AWS S3 and provides very high durability. However, the costs are a little higher. Glacier is for archival and the files are not available over the internet. Reduced Redundancy Storage is for less critical files. Reduced Redundancy is little cheaper as it provides less durability in comparison to S3. In this case since the log files are not mission critical files, RRS will be a better option. QUESTION: 90 A user has created a VPC with CIDR 20.0.0.0/24. The user has created a public subnet with CIDR 20.0.0.0/25. The user is trying to create the private subnet with CIDR 20.0.0.128/25. Which of the below mentioned statements is true in this scenario? A. It will not allow the user to create the private subnet due to a CIDR overlap B. It will allow the user to create a private subnet with CIDR as 20.0.0.128/25 C. This statement is wrong as AWS does not allow CIDR 20.0.0.0/25 D. It will not allow the user to create a private subnet due to a wrong CIDR range Answer: B Explanation: When the user creates a subnet in VPC, he specifies the CIDR block for the subnet. The CIDR block of a subnet can be the same as the CIDR block for the VPC (for a single subnet in the VPC., or a subset (to enable multiple subnets.. If the user creates more than one subnet in a VPC, the CIDR blocks of the subnets must not overlap. Thus, in this case the user has created a VPC with the CIDR block 20.0.0.0/24, which supports 256 IP addresses (20.0.0.0 to 20.0.0.255.. The user can break this CIDR block into two subnets, each supporting 128 IP addresses. One subnet uses the CIDR block 20.0.0.0/25 (for addresses 20.0.0.0 - 20.0.0.127. and the other uses the CIDR block 20.0.0.128/25 (for addresses 20.0.0.128 - 20.0.0.255.. QUESTION: 91 AWS-SysOps 44http://www.examarea.comhttp://www.fravo.com A user has created an S3 bucket which is not publicly accessible. The bucket is having thirty objects which are also private. If the user wants to make the objects public, how can he configure this with minimal efforts? A. The user should select all objects from the console and apply a single policy to mark them public B. The user can write a program which programmatically makes all objects public using S3 SDK C. Set the AWS bucket policy which marks all objects as public D. Make the bucket ACL as public so it will also mark all objects as public Answer: C Explanation: A system admin can grant permission of the S3 objects or buckets to any user or make the objects public using the bucket policy and user policy. Both use the JSON-based access policy language. Generally if the user is defining the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be defined at the bucket level which allows the objects as well as the bucket to be public with a single policy applied to that bucket. QUESTION: 92 A sys admin is maintaining an application on AWS. The application is installed on EC2 and user has configured ELB and Auto Scaling. Considering future load increase, the user is planning to launch new servers proactively so that they get registered with ELB. How can the user add these instances with Auto Scaling? A. Increase the desired capacity of the Auto Scaling group B. Increase the maximum limit of the Auto Scaling group C. Launch an instance manually and register it with ELB on the fly D. Decrease the minimum limit of the Auto Scaling grou Answer: A Explanation: A user can increase the desired capacity of the Auto Scaling group and Auto Scaling will launch a new instance as per the new capacity. The newly launched instances will be registered with ELB if Auto Scaling group is configured with ELB. If the user decreases the minimum size the instances will be removed from Auto Scaling. Increasing the maximum size will not add instances but only set the maximum instance cap. AWS-SysOps 45http://www.examarea.comhttp://www.fravo.com QUESTION: 93 An organization, which has the AWS account ID as 999988887777, has created 50 IAM users. All the users are added to the same group cloudacademy. If the organization has enabled that each IAM user can login with the AWS console, which AWS login URL will the IAM users use? A. https:// 999988887777.signin.aws.amazon.com/console/ B. https:// signin.aws.amazon.com/cloudacademy/ C. https:// cloudacademy.signin.aws.amazon.com/999988887777/console/ D. https:// 999988887777.aws.amazon.com/ cloudacademy/ Answer: A Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. Once the organization has created the IAM users, they will have a separate AWS console URL to login to the AWS console. The console login URL for the IAM user will be https:// AWS_Account_ID.signin.aws.amazon.com/console/. It uses only the AWS account ID and does not depend on the group or user ID. QUESTION: 94 A user has setup connection draining with ELB to allow in-flight requests to continue while the instance is being deregistered through Auto Scaling. If the user has not specified the draining time, how long will ELB allow inflight requests traffic to continue? A. 600 seconds B. 3600 seconds C. 300 seconds D. 0 seconds Answer: C Explanation: The Elastic Load Balancer connection draining feature causes the load balancer to stop sending new requests to the back-end instances when the instances are deregistering or become unhealthy, while ensuring that inflight requests continue to be served. The user can specify a maximum time (3600 seconds. for the load balancer to keep the AWS-SysOps 46http://www.examarea.comhttp://www.fravo.com connections alive before reporting the instance as deregistered. If the user does not specify the maximum timeout period, by default, the load balancer will close the connections to the deregistering instance after 300 seconds. QUESTION: 95 A root AWS account owner is trying to understand various options to set the permission to AWS S3. Which of the below mentioned options is not the right option to grant permission for S3? A. User Access Policy B. S3 Object Access Policy C. S3 Bucket Access Policy D. S3 ACL Answer: B Explanation: Amazon S3 provides a set of operations to work with the Amazon S3 resources. Managing S3 resource access refers to granting others permissions to work with S3. There are three ways the root account owner can define access with S3: S3 ACL: The user can use ACLs to grant basic read/write permissions to other AWS accounts. S3 Bucket Policy: The policy is used to grant other AWS accounts or IAM users permissions for the bucket and the objects in it. User Access Policy: Define an IAM user and assign him the IAM policy which grants him access to S3. QUESTION: 96 A sys admin has created a shopping cart application and hosted it on EC2. The EC2 instances are running behind ELB. The admin wants to ensure that the end user request will always go to the EC2 instance where the user session has been created. How can the admin configure this? A. Enable ELB cross zone load balancing B. Enable ELB cookie setup C. Enable ELB sticky session D. Enable ELB connection draining Answer: C Explanation: AWS-SysOps 47http://www.examarea.comhttp://www.fravo.com Generally AWS ELB routes each request to a zone with the minimum load. The Elastic Load Balancer provides a feature called sticky session which binds the user’s session with a specific EC2 instance. If the sticky session is enabled the first request from the user will be redirected to any of the EC2 instances. But, henceforth, all requests from the same user will be redirected to the same EC2 instance. This ensures that all requests coming from the user during the session will be sent to the same application instance. QUESTION: 97 A user has configured ELB with three instances. The user wants to achieve High Availability as well as redundancy with ELB. Which of the below mentioned AWS services helps the user achieve this for ELB? A. Route 53 B. AWS Mechanical Turk C. Auto Scaling D. AWS EMR Answer: A Explanation: The user can provide high availability and redundancy for applications running behind Elastic Load Balancer by enabling the Amazon Route 53 Domain Name System (DNS. failover for the load balancers. Amazon Route 53 is a DNS service that provides reliable routing to the user’s infrastructure. QUESTION: 98 An organization is using AWS since a few months. The finance team wants to visualize the pattern of AWS spending. Which of the below AWS tool will help for this requirement? A. AWS Cost Manager B. AWS Cost Explorer C. AWS CloudWatch D. AWS Consolidated Billing Answer: B Explanation: The AWS Billing and Cost Management console includes the Cost Explorer tool for viewing AWS cost data as a graph. It does not charge extra to user for this service. AWS-SysOps 48http://www.examarea.comhttp://www.fravo.com With Cost Explorer the user can filter graphs using resource tags or with services in AWS. If the organization is using Consolidated Billing it helps generate report based on linked accounts. This will help organization to identify areas that require further inquiry. The organization can view trends and use that to understand spend and to predict future costs. QUESTION: 99 A user has launched an ELB which has 5 instances registered with it. The user deletes the ELB by mistake. What will happen to the instances? A. ELB will ask the user whether to delete the instances or not B. Instances will be terminated C. ELB cannot be deleted if it has running instances registered with it D. Instances will keep running Answer: D Explanation: When the user deletes the Elastic Load Balancer, all the registered instances will be deregistered. However, they will continue to run. The user will incur charges if he does not take any action on those instances. QUESTION: 100 A user is planning to setup notifications on the RDS DB for a snapshot. Which of the below mentioned event categories is not supported by RDS for this snapshot source type? A. Backup B. Creation C. Deletion D. Restoration Answer: A Explanation: Amazon RDS uses the Amazon Simple Notification Service to provide a notification when an Amazon RDS event occurs. Event categories for a snapshot source type include: Creation, Deletion, and Restoration. The Backup is a part of DB instance source type. AWS-SysOps 49http://www.examarea.comhttp://www.fravo.com QUESTION: 101 A customer is using AWS for Dev and Test. The customer wants to setup the Dev environment with Cloudformation. Which of the below mentioned steps are not required while using Cloudformation? A. Create a stack B. Configure a service C. Create and upload the template D. Provide the parameters configured as part of the template Answer: B Explanation: AWS Cloudformation is an application management tool which provides application modelling, deployment, configuration, management and related activities. AWS CloudFormation introduces two concepts: the template and the stack. The template is a JSON-format, text-based file that describes all the AWS resources required to deploy and run an application. The stack is a collection of AWS resources which are created and managed as a single unit when AWS CloudFormation instantiates a template. While creating a stack, the user uploads the template and provides the data for the parameters if required. QUESTION: 102 A user has configured the AWS CloudWatch alarm for estimated usage charges in the US East region. Which of the below mentioned statements is not true with respect to the estimated charges? Exhibit: AWS-SysOps 50http://www.examarea.comhttp://www.fravo.com A. It will store the estimated charges data of the last 14 days B. It will include the estimated charges of every AWS service C. The metric data will represent the data of all the regions D. The metric data will show data specific to that region Answer: D Explanation: When the user has enabled the monitoring of estimated charges for the AWS account with AWS CloudWatch, the estimated charges are calculated and sent several times daily to CloudWatch in the form of metric data. This data will be stored for 14 days. The billing metric data is stored in the US East (Northern Virginia. Region and represents worldwide charges. This data also includes the estimated charges for every service in AWS used by the user, as well as the estimated overall AWS charges. QUESTION: 103 A user is accessing RDS from an application. The user has enabled the Multi AZ feature with the MS SQL RDS DB. During a planned outage how will AWS ensure that AWS-SysOps 51http://www.examarea.comhttp://www.fravo.com a switch from DB to a standby replica will not affect access to the application? A. RDS will have an internal IP which will redirect all requests to the new DB B. RDS uses DNS to switch over to stand by replica for seamless transition C. The switch over changes Hardware so RDS does not need to worry about access D. RDS will have both the DBs running independently and the user has to manually switch over Answer: B Explanation: In the event of a planned or unplanned outage of a DB instance, Amazon RDS automatically switches to a standby replica in another Availability Zone if the user has enabled Multi AZ. The automatic failover mechanism simply changes the DNS record of the DB instance to point to the standby DB instance. As a result, the user will need to re-establish any existing connections to the DB instance. However, as the DNS is the same, the application can access DB seamlessly. QUESTION: 104 An organization is generating digital policy files which are required by the admins for verification. Once the files are verified they may not be required in the future unless there is some compliance issue. If the organization wants to save them in a cost effective way, which is the best possible solution? A. AWS RRS B. AWS S3 C. AWS RDS D. AWS Glacier Answer: D Explanation: Amazon S3 stores objects according to their storage class. There are three major storage classes: Standard, Reduced Redundancy and Glacier. Standard is for AWS S3 and provides very high durability. However, the costs are a little higher. Reduced redundancy is for less critical files. Glacier is for archival and the files which are accessed infrequently. It is an extremely low-cost storage service that provides secure and durable storage for data archiving and backup. QUESTION: 105 AWS-SysOps 52http://www.examarea.comhttp://www.fravo.com A user has launched an EBS backed instance. The user started the instance at 9 AM in the morning. Between 9 AM to 10 AM, the user is testing some script. Thus, he stopped the instance twice and restarted it. In the same hour the user rebooted the instance once. For how many instance hours will AWS charge the user? A. 3 hours B. 4 hours C. 2 hours D. 1 hour Answer: A Explanation: A user can stop/start or reboot an EC2 instance using the AWS console, the Amazon EC2 CLI or the Amazon EC2 API. Rebooting an instance is equivalent to rebooting an operating system. When the instance is rebooted AWS will not charge the user for the extra hours. In case the user stops the instance, AWS does not charge the running cost but charges only the EBS storage cost. If the user starts and stops the instance multiple times in a single hour, AWS will charge the user for every start and stop. In this case, since the instance was rebooted twice, it will cost the user for 3 instance hours. QUESTION: 106 An organization has configured the custom metric upload with CloudWatch. The organization has given permission to its employees to upload data using CLI as well SDK. How can the user track the calls made to CloudWatch? A. The user can enable logging with CloudWatch which logs all the activities B. Use CloudTrail to monitor the API calls C. Create an IAM user and allow each user to log the data using the S3 bucket D. Enable detailed monitoring with CloudWatch Answer: B Explanation: AWS CloudTrail is a web service which will allow the user to monitor the calls made to the Amazon CloudWatch API for the organization’s account, including calls made by the AWS Management Console, Command Line Interface (CLI., and other services. When CloudTrail logging is turned on, CloudWatch will write log files into the Amazon S3 bucket, which is specified during the CloudTrail configuration. QUESTION: 107 AWS-SysOps 53http://www.examarea.comhttp://www.fravo.com A user has created a queue named “myqueue” with SQS. There are four messages published to queue which are not received by the consumer yet. If the user tries to delete the queue, what will happen? A. A user can never delete a queue manually. AWS deletes it after 30 days of inactivity on queue B. It will delete the queue C. It will initiate the delete but wait for four days before deleting until all messages are deleted automatically. D. I t will ask user to delete the messages first Answer: B Explanation: SQS allows the user to move data between distributed components of applications so they can perform different tasks without losing messages or requiring each component to be always available. The user can delete a queue at any time, whether it is empty or not. It is important to note that queues retain messages for a set period of time. By default, a queue retains messages for four days. QUESTION: 108 A user has launched a large EBS backed EC2 instance in the US-East-1a region. The user wants to achieve Disaster Recovery (DR. for that instance by creating another small instance in Europe. How can the user achieve DR? A. Copy the running instance using the “Instance Copy” command to the EU region B. Create an AMI of the instance and copy the AMI to the EU region. Then launch the instance from the EU AMI C. Copy the instance from the US East region to the EU region D. Use the “Launch more like this” option to copy the instance from one region to another Answer: B Explanation: To launch an EC2 instance it is required to have an AMI in that region. If the AMI is not available in that region, then create a new AMI or use the copy command to copy the AMI from one region to the other region. QUESTION: 109 AWS-SysOps 54http://www.examarea.comhttp://www.fravo.com A user has created numerous EBS volumes. What is the general limit for each AWS account for the maximum number of EBS volumes that can be created? A. 10000 B. 5000 C. 100 D. 1000 Answer: B Explanation: A user can attach multiple EBS volumes to the same instance within the limits specified by his AWS account. Each AWS account has a limit on the number of Amazon EBS volumes that the user can create, and the total storage available. The default limit for the maximum number of volumes that can be created is 5000. QUESTION: 110 A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created a public subnet CIDR (20.0.0.0/24. and VPN only subnets CIDR (20.0.1.0/24. along with the VPN gateway (vgw-12345. to connect to the user’s data centre. Which of the below mentioned options is a valid entry for the main route table in this scenario? A. Destination: 20.0.0.0/24 and Target: vgw-12345 B. Destination: 20.0.0.0/16 and Target: ALL C. Destination: 20.0.1.0/16 and Target: vgw-12345 D. Destination: 0.0.0.0/0 and Target: vgw-12345 Answer: D Explanation: The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data centre, he can setup a public and VPN only subnet which uses hardware VPN access to connect with his data centre. When the user has configured this setup with Wizard, it will create a virtual private gateway to route all traffic of the VPN subnet. Here are the valid entries for the main route table in this scenario: Destination: 0.0.0.0/0 & Target: vgw-12345 (To route all internet traffic to the VPN gateway. Destination: 20.0.0.0/16 & Target: local (To allow local routing in VPC. QUESTION: 111 A user has stored data on an encrypted EBS volume. The user wants to share the data AWS-SysOps 55http://www.examarea.comhttp://www.fravo.com with his friend’s AWS account. How can user achieve this? A. Create an AMI from the volume and share the AMI B. Copy the data to an unencrypted volume and then share C. Take a snapshot and share the snapshot with a friend D. If both the accounts are using the same encryption key then the user can share the volume directly Answer: B Explanation: AWS EBS supports encryption of the volume. It also supports creating volumes from existing snapshots provided the snapshots are created from encrypted volumes. If the user is having data on an encrypted volume and is trying to share it with others, he has to copy the data from the encrypted volume to a new unencrypted volume. Only then can the user share it as an encrypted volume data. Otherwise the snapshot cannot be shared. QUESTION: 112 A user has enabled the Multi AZ feature with the MS SQL RDS database server. Which of the below mentioned statements will help the user understand the Multi AZ feature better? A. In a Multi AZ, AWS runs two DBs in parallel and copies the data asynchronously to the replica copy B. In a Multi AZ, AWS runs two DBs in parallel and copies the data synchronously to the replica copy C. In a Multi AZ, AWS runs just one DB but copies the data synchronously to the standby replica D. AWS MS SQL does not support the Multi AZ feature Answer: C Explanation: Amazon RDS provides high availability and failover support for DB instances using Multi-AZ deployments. In a Multi-AZ deployment, Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. The primary DB instance is synchronously replicated across Availability Zones to a standby replica to provide data redundancy, eliminate I/O freezes, and minimize latency spikes during system backups. Running a DB instance with high availability can enhance availability during planned system maintenance, and help protect your AWS-SysOps 56http://www.examarea.comhttp://www.fravo.com databases against DB instance failure and Availability Zone disruption.Note that the high-availability feature is not a scaling solution for read-only scenarios; you cannot use a standby replica to serve read traffic. To service read-only traffic, you should use a read replica. QUESTION: 113 An organization is using cost allocation tags to find the cost distribution of different departments and projects. One of the instances has two separate tags with the key/ value as “InstanceName/HR”, “CostCenter/HR”. What will AWS do in this case? A. InstanceName is a reserved tag for AWS. Thus, AWS will not allow this tag B. AWS will not allow the tags as the value is the same for different keys C. AWS will allow tags but will not show correctly in the cost allocation report due to the same value of the two separate keys D. AWS will allow both the tags and show properly in the cost distribution report Answer: D Explanation: AWS provides cost allocation tags to categorize and track the AWS costs. When the user applies tags to his AWS resources, AWS generates a cost allocation report as a comma-separated value (CSV file. with the usage and costs aggregated by those tags. Each tag will have a key-value and can be applied to services, such as EC2, S3, RDS, EMR, etc. It is required that the key should be different for each tag. The value can be the same for different keys. In this case since the value is different, AWS will properly show the distribution report with the correct values. QUESTION: 114 A user is publishing custom metrics to CloudWatch. Which of the below mentioned statements will help the user understand the functionality better? A. The user can use the CloudWatch Import tool B. The user should be able to see the data in the console after around 15 minutes C. If the user is uploading the custom data, the user must supply the namespace, timezone, and metric name as part of the command D. The user can view as well as upload data using the console, CLI and APIs Answer: B Explanation: AWS-SysOps 57http://www.examarea.comhttp://www.fravo.com AWS CloudWatch supports the custom metrics. The user can always capture the custom data and upload the data to CloudWatch using CLI or APIs. The user has to always include the namespace as a part of the request. However, the other parameters are optional. If the user has uploaded data using CLI, he can view it as a graph inside the console. The data will take around 2 minutes to upload but can be viewed only after around 15 minutes. QUESTION: 115 A user is launching an EC2 instance in the US East region. Which of the below mentioned options is recommended by AWS with respect to the selection of the availability zone? A. Always select the US-East-1-a zone for HA B. Do not select the AZ; instead let AWS select the AZ C. The user can never select the availability zone while launching an instance D. Always select the AZ while launching an instance Answer: B Explanation: When launching an instance with EC2, AWS recommends not to select the availability zone (AZ.. AWS specifies that the default Availability Zone should be accepted. This is because it enables AWS to select the best Availability Zone based on the system health and available capacity. If the user launches additional instances, only then an Availability Zone should be specified. This is to specify the same or different AZ from the running instances. QUESTION: 116 A user has created a VPC with CIDR 20.0.0.0/16 with only a private subnet and VPN connection using the VPC wizard. The user wants to connect to the instance in a private subnet over SSH. How should the user define the security rule for SSH? A. Allow Inbound traffic on port 22 from the user’s network B. The user has to create an instance in EC2 Classic with an elastic IP and configure the security group of a private subnet to allow SSH from that elastic IP C. The user can connect to a instance in a private subnet using the NAT instance D. Allow Inbound traffic on port 80 and 22 to allow the user to connect to a private subnet over the Internet AWS-SysOps 58http://www.examarea.comhttp://www.fravo.com Answer: A Explanation: The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data centre, the user can setup a case with a VPN only subnet (private. which uses VPN access to connect with his data centre. When the user has configured this setup with Wizard, all network connections to the instances in the subnet will come from his data centre. The user has to configure the security group of the private subnet which allows the inbound traffic on SSH (port 22. from the data centre’s network range. QUESTION: 117 A user has created an ELB with the availability zone US-East-1A. The user wants to add more zones to ELB to achieve High Availability. How can the user add more zones to the existing ELB? A. It is not possible to add more zones to the existing ELB B. The only option is to launch instances in different zones and add to ELB C. The user should stop the ELB and add zones and instances as required D. The user can add zones on the fly from the AWS console Answer: D Explanation: The user has created an Elastic Load Balancer with the availability zone and wants to add more zones to the existing ELB. The user can do so in two ways: From the console or CLI, add new zones to ELB; Launch instances in a separate AZ and add instances to the existing ELB. QUESTION: 118 A user has configured an Auto Scaling group with ELB. The user has enabled detailed CloudWatch monitoring on Elastic Load balancing. Which of the below mentioned statements will help the user understand this functionality better? A. ELB sends data to CloudWatch every minute only and does not charge the user B. ELB will send data every minute and will charge the user extra C. ELB is not supported by CloudWatch D. It is not possible to setup detailed monitoring for ELB Answer: A AWS-SysOps 59http://www.examarea.comhttp://www.fravo.com Explanation: CloudWatch is used to monitor AWS as well as the custom services. It provides either basic or detailed monitoring for the supported AWS products. In basic monitoring, a service sends data points to CloudWatch every five minutes, while in detailed monitoring a service sends data points to CloudWatch every minute. Elastic Load Balancing includes 10 metrics and 2 dimensions, and sends data to CloudWatch every minute. This does not cost extra. QUESTION: 119 A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB? A. The client can connect over IPV4 or IPV6 using Dualstack B. ELB DNS supports both IPV4 and IPV6 C. Communication between the load balancer and back-end instances is always through IPV4 D. The ELB supports either IPV4 or IPV6 but not both Answer: D Explanation: Elastic Load Balancing supports both Internet Protocol version 6 (IPv6. and Internet Protocol version 4 (IPv4.. Clients can connect to the user’s load balancer using either IPv4 or IPv6 (in EC2- Classic. DNS. However, communication between the load balancer and its back-end instances uses only IPv4. The user can use the Dualstackprefixed DNS name to enable IPv6 support for communications between the client and the load balancers. Thus, the clients are able to access the load balancer using either IPv4 or IPv6 as their individual connectivity needs dictate. QUESTION: 120 A user has received a message from the support team that an issue occurred 1 week back between 3 AM to 4 AM and the EC2 server was not reachable. The user is checking the CloudWatch metrics of that instance. How can the user find the data easily using the CloudWatch console? A. The user can find the data by giving the exact values in the time Tab under CloudWatch metrics B. The user can find the data by filtering values of the last 1 week for a 1 hour period in the Relative tab under CloudWatch metrics AWS-SysOps 60http://www.examarea.comhttp://www.fravo.com C. It is not possible to find the exact time from the console. The user has to use CLI to provide the specific time D. The user can find the data by giving the exact values in the Absolute tab under CloudWatch metrics Answer: D Explanation: If the user is viewing the data inside the CloudWatch console, the console provides options to filter values either using the relative period, such as days /hours or using the Absolute tab where the user can provide data with a specific date and time. The console also provides the option to search using the local timezone under the time range caption in the console. QUESTION: 121 A user has setup Auto Scaling with ELB on the EC2 instances. The user wants to configure that whenever the CPU utilization is below 10%, Auto Scaling should remove one instance. How can the user configure this? A. The user can get an email using SNS when the CPU utilization is less than 10%. The user can use the desired capacity of Auto Scaling to remove the instance B. Use CloudWatch to monitor the data and Auto Scaling to remove the instances using scheduled actions C. Configure CloudWatch to send a notification to Auto Scaling Launch configuration when the CPU utilization is less than 10% and configure the Auto Scaling policy to remove the instance D. Configure CloudWatch to send a notification to the Auto Scaling group when the CPU Utilization is less than 10% and configure the Auto Scaling policy to remove the instance Answer: D Explanation: Amazon CloudWatch alarms watch a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The user can setup to receive a notification on the Auto Scaling group with the CloudWatch alarm when the CPU utilization is below a certain threshold. The user can configure the Auto Scaling policy to take action for removing the instance. When the CPU utilization is below 10% CloudWatch will send an alarm to the Auto Scaling group to execute the policy. AWS-SysOps 61http://www.examarea.comhttp://www.fravo.com QUESTION: 122 A user has enabled detailed CloudWatch metric monitoring on an Auto Scaling group. Which of the below mentioned metrics will help the user identify the total number of instances in an Auto Scaling group cluding pending, terminating and running instances? A. GroupTotalInstances B. GroupSumInstances C. It is not possible to get a count of all the three metrics together. The user has to find the individual number of running, terminating and pending instances and sum it D. GroupInstancesCount Answer: A Explanation: CloudWatch is used to monitor AWS as well as the custom services. For Auto Scaling, CloudWatch provides various metrics to get the group information, such as the Number of Pending, Running or Terminating instances at any moment. If the user wants to get the total number of Running, Pending and Terminating instances at any moment, he can use the GroupTotalInstances metric. QUESTION: 123 A user is trying to configure the CloudWatch billing alarm. Which of the below mentioned steps should be performed by the user for the first time alarm creation in the AWS Account Management section? A. Enable Receiving Billing Reports B. Enable Receiving Billing Alerts C. Enable AWS billing utility D. Enable CloudWatch Billing Threshold Answer: B Explanation: AWS CloudWatch supports enabling the billing alarm on the total AWS charges. Before the user can create an alarm on the estimated charges, he must enable monitoring of the estimated AWS charges, by selecting the option “Enable receiving billing alerts”. It takes about 15 minutes before the user can view the billing data. The user can then create the alarms. AWS-SysOps 62http://www.examarea.comhttp://www.fravo.com QUESTION: 124 A user is checking the CloudWatch metrics from the AWS console. The user notices that the CloudWatch data is coming in UTC. The user wants to convert the data to a local time zone. How can the user perform this? A. In the CloudWatch dashboard the user should set the local timezone so that CloudWatch shows the data only in the local time zone B. In the CloudWatch console select the local timezone under the Time Range tab to view the data as per the local timezone C. The CloudWatch data is always in UTC; the user has to manually convert the data D. The user should have send the local timezone while uploading the data so that CloudWatch will show the data only in the local timezone Answer: B Explanation: If the user is viewing the data inside the CloudWatch console, the console provides options to filter values either using the relative period, such as days/hours or using the Absolute tab where the user can provide data with a specific date and time. The console also provides the option to search using the local timezone under the time range caption in the console because the time range tab allows the user to change the time zone. QUESTION: 125 An organization (Account ID 123412341234. has attached the below mentioned IAM policy to a user. What does this policy statement entitle the user to perform? "Statement": [ { "Sid": "AllowUsersAllActionsForCredentials", "Effect": "Allow", "Action": [ "iam:*AccessKey*", ], "Resource": ["arn:aws:iam:: 123412341234:user/${aws:username}"] } ] A. 0 B. 0 AWS-SysOps 63http://www.examarea.comhttp://www.fravo.com C. 0 D. 0 Answer: A Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. If the organization (Account ID 123412341234. wants some of their users to manage keys (access and secret access keys. of all IAM users, the organization should set the below mentioned policy which entitles the IAM user to modify keys of all IAM users with CLI, SDK or API. "Statement": [ { "Sid": "AllowUsersAllActionsForCredentials", "Effect": "Allow", "Action": [ "iam:*AccessKey*", ], "Resource": ["arn:aws:iam:: 123412341234:user/${aws:username}"] } ] QUESTION: 126 A user is trying to connect to a running EC2 instance using SSH. However, the user gets a connection time out error. Which of the below mentioned options is not a possible reason for rejection? A. The access key to connect to the instance is wrong B. The security group is not configured properly C. The private key used to launch the instance is not correct D. The instance CPU is heavily loaded Answer: A Explanation: If the user is trying to connect to a Linux EC2 instance and receives the connection time out error the probable reasons are: Security group is not configured with the SSH port The private key pair is not right The user name to login is wrong The instance CPU is heavily loaded, so it does not allow more connections AWS-SysOps 64http://www.examarea.comhttp://www.fravo.com QUESTION: 127 A user has configured Elastic Load Balancing by enabling a Secure Socket Layer (SSL. Negotiation configuration known as a Security Policy. Which of the below mentioned options is not part of this secure policy while negotiating the SSL connection between the user and the client? A. SSL Protocols B. Client Order Preference C. SSL Ciphers D. Server Order Preference Answer: B Explanation: Elastic Load Balancing uses a Secure Socket Layer (SSL. negotiation configuration which is known as a Security Policy. It is used to negotiate the SSL connections between a client and the load balancer. A security policy is a combination of SSL Protocols, SSL Ciphers, and the Server Order Preference option. QUESTION: 128 A user has configured CloudWatch monitoring on an EBS backed EC2 instance. If the user has not attached any additional device, which of the below mentioned metrics will always show a 0 value? A. DiskReadBytes B. NetworkIn C. NetworkOut D. CPUUtilization Answer: A Explanation: CloudWatch is used to monitor AWS as the well custom services. For EC2 when the user is monitoring the EC2 instances, it will capture the 7 Instance level and 3 system check parameters for the EC2 instance. Since this is an EBS backed instance, it will not have ephermal storage attached to it. Out of the 7 EC2 metrics, the 4 metrics DiskReadOps, DiskWriteOps, DiskReadBytes and DiskWriteBytes are disk related data and available only when there is ephermal storage attached to an instance. For an EBS backed instance without any additional device, this data will be 0. AWS-SysOps 65http://www.examarea.comhttp://www.fravo.com QUESTION: 129 A user has launched an EBS backed EC2 instance. What will be the difference while performing the restart or stop/start options on that instance? A. For restart it does not charge for an extra hour, while every stop/start it will be charged as a separate hour B. Every restart is charged by AWS as a separate hour, while multiple start/stop actions during a single hour will be counted as a single hour C. For every restart or start/stop it will be charged as a separate hour D. For restart it charges extra only once, while for every stop/start it will be charged as a separate hour Answer: A Explanation: For an EC2 instance launched with an EBS backed AMI, each time the instance state is changed from stop to start/ running, AWS charges a full instance hour, even if these transitions happen multiple times within a single hour. Anyway, rebooting an instance AWS does not charge a new instance billing hour. QUESTION: 130 A user has created a queue named “myqueue” in US-East region with AWS SQS. The user’s AWS account ID is 123456789012. If the user wants to perform some action on this queue, which of the below Queue URL should he use? A. http://sqs.us-east-1.amazonaws.com/123456789012/myqueue B. http://sqs.amazonaws.com/123456789012/myqueue C. http://sqs. 123456789012.us-east-1.amazonaws.com/myqueue D. http:// 123456789012.sqs. us-east-1.amazonaws.com/myqueue Answer: A Explanation: When creating a new queue in SQS, the user must provide a queue name that is unique within the scope of all queues of user’s account. If the user creates queues using both the latest WSDL and a previous version, he will have a single namespace for all his queues. Amazon SQS assigns each queue created by user an identifier called a queue URL, which includes the queue name and other components that Amazon SQS determines. Whenever the user wants to perform an action on a queue, he must provide its queue URL. The queue URL for the account id 123456789012 & queue name “myqueue” in US-East-1 region will be http:// sqs.us-east- AWS-SysOps 66http://www.examarea.comhttp://www.fravo.com 1.amazonaws.com/123456789012/myqueue. QUESTION: 131 A sys admin is trying to understand the Auto Scaling activities. Which of the below mentioned processes is not performed by Auto Scaling? A. Reboot Instance B. Schedule Actions C. Replace Unhealthy D. Availability Zone Balancing Answer: A Explanation: There are two primary types of Auto Scaling processes: Launch and Terminate, which launch or terminat instances, respectively. Some other actions performed by Auto Scaling are: AddToLoadbalancer, AlarmNotification, HealthCheck, AZRebalance, ReplaceUnHealthy, and ScheduledActions. QUESTION: 132 A sys admin is trying to understand EBS snapshots. Which of the below mentioned statements will not be useful to the admin to understand the concepts about a snapshot? A. The snapshot is synchronous B. It is recommended to stop the instance before taking a snapshot for consistent data C. The snapshot is incremental D. The snapshot captures the data that has been written to the hard disk when the snapshot command was executed Answer: A Explanation: The AWS snapshot is a point in time backup of an EBS volume. When the snapshot command is executed it will capture the current state of the data that is written on the drive and take a backup. For a better and consistent snapshot of the root EBS volume, AWS recommends stopping the instance. For additional volumes it is recommended to unmount the device. The snapshots are asynchronous and incremental. AWS-SysOps 67http://www.examarea.comhttp://www.fravo.com QUESTION: 133 A root account owner has created an S3 bucket testmycloud. The account owner wants to allow everyone to upload the objects as well as enforce that the person who uploaded the object should manage the permission of those objects. Which is the easiest way to achieve this? A. The root account owner should create a bucket policy which allows the IAM users to upload the object B. The root account owner should create the bucket policy which allows the other account owners to set the object policy of that bucket C. The root account should use ACL with the bucket to allow everyone to upload the object D. The root account should create the IAM users and provide them the permission to upload content to the bucket Answer: C Explanation: Each AWS S3 bucket and object has an ACL (Access Control List. associated with it. An ACL is a list of grants identifying the grantee and the permission granted. The user can use ACLs to grant basic read/write permissions to other AWS accounts. ACLs use an Amazon S3–specific XML schema. The user cannot grant permissions to other users in his account. ACLs are suitable for specific scenarios. For example, if a bucket owner allows other AWS accounts to upload objects, permissions to these objects can only be managed using the object ACL by the AWS account that owns the object. QUESTION: 134 An organization has setup consolidated billing with 3 different AWS accounts. Which of the below mentioned advantages will organization receive in terms of the AWS pricing? A. The consolidated billing does not bring any cost advantage for the organization B. All AWS accounts will be charged for S3 storage by combining the total storage of each account C. The EC2 instances of each account will receive a total of 750*3 micro instance hours free D. The free usage tier for all the 3 accounts will be 3 years and not a single year Answer: B Explanation: AWS-SysOps 68http://www.examarea.comhttp://www.fravo.com AWS consolidated billing enables the organization to consolidate payments for multiple Amazon Web Services (AWS. accounts within a single organization by making a single paying account. For billing purposes, AWS treats all the accounts on the consolidated bill as one account. Some services, such as Amazon EC2 and Amazon S3 have volume pricing tiers across certain usage dimensions that give the user lower prices when he uses the service more. QUESTION: 135 A user has launched two EBS backed EC2 instances in the US-East-1a region. The user wants to change the zone of one of the instances. How can the user change it? A. Stop one of the instances and change the availability zone B. The zone can only be modified using the AWS CLI C. From the AWS EC2 console, select the Actions - > Change zones and specify new zone D. Create an AMI of the running instance and launch the instance in a separate AZ Answer: D Explanation: With AWS EC2, when a user is launching an instance he can select the availability zone (AZ. at the time of launch. If the zone is not selected, AWS selects it on behalf of the user. Once the instance is launched, the user cannot change the zone of that instance unless he creates an AMI of that instance and launches a new instance from it. QUESTION: 136 A user wants to make so that whenever the CPU utilization of the AWS EC2 instance is above 90%, the redlight of his bedroom turns on. Which of the below mentioned AWS services is helpful for this purpose? A. AWS CloudWatch + AWS SES B. AWS CloudWatch + AWS SNS C. None. It is not possible to configure the light with the AWS infrastructure services D. AWS CloudWatch and a dedicated software turning on the light Answer: B Explanation: Amazon Simple Notification Service (Amazon SNS. is a fast, flexible, and fully managed push messaging service. Amazon SNS can deliver notifications by SMS text AWS-SysOps 69http://www.examarea.comhttp://www.fravo.com message or email to the Amazon Simple Queue Service (SQS. queues or to any HTTP endpoint. The user can configure some sensor devices at his home which receives data on the HTTP end point (REST calls. and turn on the red light. The user can configure the CloudWatch alarm to send a notification to the AWS SNS HTTP end point (the sensor device. and it will turn the light red when there is an alarm condition. QUESTION: 137 An organization has added 3 of his AWS accounts to consolidated billing. One of the AWS accounts has purchased a Reserved Instance (RI. of a small instance size in the US-East-1a zone. All other AWS accounts are running instances of a small size in the same zone. What will happen in this case for the RI pricing? A. Only the account that has purchased the RI will get the advantage of RI pricing B. One instance of a small size and running in the US-East-1a zone of each AWS account will get the benefit of RI pricing C. Any single instance from all the three accounts can get the benefit of AWS RI pricing if they are running in the same zone and are of the same size D. If there are more than one instances of a small size running across multiple accounts in the same zone no one will get the benefit of RI Answer: C Explanation: AWS consolidated billing enables the organization to consolidate payments for multiple Amazon Web Services (AWS. accounts within a single organization by making a single paying account. For billing purposes, consolidated billing treats all the accounts on the consolidated bill as one account. This means that all accounts on a consolidated bill can receive the hourly cost benefit of the Amazon EC2 Reserved Instances purchased by any other account. In this case only one Reserved Instance has been purchased by one account. Thus, only a single instance from any of the accounts will get the advantage of RI. AWS will implement the blended rate for each instance if more than one instance is running concurrently. QUESTION: 138 An organization is planning to use AWS for 5 different departments. The finance department is responsible to pay for all the accounts. However, they want the cost separation for each account to map with the right cost centre. How can the finance department achieve this? A. Create 5 separate accounts and make them a part of one consolidate billing B. Create 5 separate accounts and use the IAM cross account access with the roles for AWS-SysOps 70http://www.examarea.comhttp://www.fravo.com better management C. Create 5 separate IAM users and set a different policy for their access D. Create 5 separate IAM groups and add users as per the department’s employees Answer: A Explanation: AWS consolidated billing enables the organization to consolidate payments for multiple Amazon Web Services (AWS. accounts within a single organization by making a single paying account. Consolidated billing enables the organization to see a combined view of the AWS charges incurred by each account as well as obtain a detailed cost report for each of the individual AWS accounts associated with the paying account. QUESTION: 139 A user has setup an EBS backed instance and a CloudWatch alarm when the CPU utilization is more than 65%. The user has setup the alarm to watch it for 5 periods of 5 minutes each. The CPU utilization is 60% between 9 AM to 6 PM. The user has stopped the EC2 instance for 15 minutes between 11 AM to 11:15 AM. What will be the status of the alarm at 11:30 AM? A. Alarm B. OK C. Insufficient Data D. Error Answer: B Explanation: Amazon CloudWatch alarm watches a single metric over a time period the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The state of the alarm will be OK for the whole day. When the user stops the instance for three periods the alarm may not receive the data QUESTION: 140 A user is running one instance for only 3 hours every day. The user wants to save some cost with the instance. Which of the below mentioned Reserved Instance categories is advised in this case? AWS-SysOps 71http://www.examarea.comhttp://www.fravo.com A. The user should not use RI; instead only go with the on-demand pricing B. The user should use the AWS high utilized RI C. The user should use the AWS medium utilized RI D. The user should use the AWS low utilized RI Answer: A Explanation: The AWS Reserved Instance provides the user with an option to save some money by paying a one-time fixed amount and then save on the hourly rate. It is advisable that if the user is having 30% or more usage of an instance per day, he should go for a RI. If the user is going to use an EC2 instance for more than 2200-2500 hours per year, RI will help the user save some cost. Here, the instance is not going to run for less than 1500 hours. Thus, it is advisable that the user should use the on-demand pricing. QUESTION: 141 A user has setup an RDS DB with Oracle. The user wants to get notifications when someone modifies the security group of that DB. How can the user configure that? A. It is not possible to get the notifications on a change in the security group B. Configure SNS to monitor security group changes C. Configure event notification on the DB security group D. Configure the CloudWatch alarm on the DB for a change in the security group Answer: C Explanation: Amazon RDS uses the Amazon Simple Notification Service to provide a notification when an Amazon RDS event occurs. These events can be configured for source categories, such as DB instance, DB security group, DB snapshot and DB parameter group. If the user is subscribed to a Configuration Change category for a DB security group, he will be notified when the DB security group is changed. QUESTION: 142 A user is trying to setup a recurring Auto Scaling process. The user has setup one process to scale up every day at 8 am and scale down at 7 PM. The user is trying to setup another recurring process which scales up on the 1st of every month at 8 AM and scales down the same day at 7 PM. What will Auto Scaling do in this scenario? AWS-SysOps 72http://www.examarea.comhttp://www.fravo.com A. Auto Scaling will execute both processes but will add just one instance on the 1st B. Auto Scaling will add two instances on the 1st of the month C. Auto Scaling will schedule both the processes but execute only one process randomly D. Auto Scaling will throw an error since there is a conflict in the schedule of two separate Auto Scaling Processes Answer: D Explanation: Auto Scaling based on a schedule allows the user to scale the application in response to predictable load changes. The user can also configure the recurring schedule action which will follow the Linux cron format. As per Auto Scaling, a scheduled action must have a unique time value. If the user attempts to schedule an activity at a time when another existing activity is already scheduled, the call will be rejected with an error message noting the conflict. QUESTION: 143 A user is planning to setup infrastructure on AWS for the Christmas sales. The user is planning to use Auto Scaling based on the schedule for proactive scaling. What advise would you give to the user? A. It is good to schedule now because if the user forgets later on it will not scale up B. The scaling should be setup only one week before Christmas C. Wait till end of November before scheduling the activity D. It is not advisable to use scheduled based scaling Answer: C Explanation: Auto Scaling based on a schedule allows the user to scale the application in response to predictable load changes. The user can specify any date in the future to scale up or down during that period. As per Auto Scaling the user can schedule an action for up to a month in the future. Thus, it is recommended to wait until end of November before scheduling for Christmas. QUESTION: 144 A user is trying to understand the ACL and policy for an S3 bucket. Which of the below mentioned policy permissions is equivalent to the WRITE ACL on a bucket? AWS-SysOps 73http://www.examarea.comhttp://www.fravo.com A. s3:GetObjectAcl B. s3:GetObjectVersion C. s3:ListBucketVersions D. s3:DeleteObject Answer: D Explanation: Amazon S3 provides a set of operations to work with the Amazon S3 resources. Each AWS S3 bucket can have an ACL (Access Control List. or bucket policy associated with it. The WRITE ACL list allows the other AWS accounts to write/modify to that bucket. The equivalent S3 bucket policy permission for it is s3:DeleteObject. QUESTION: 145 A user has created an ELB with Auto Scaling. Which of the below mentioned offerings from ELB helps the user to stop sending new requests traffic from the load balancer to the EC2 instance when the instance is being deregistered while continuing in-flight requests? A. ELB sticky session B. ELB deregistration check C. ELB connection draining D. ELB auto registration Off Answer: C Explanation: The Elastic Load Balancer connection draining feature causes the load balancer to stop sending new requests to the back-end instances when the instances are deregistering or become unhealthy, while ensuring that inflight requests continue to be served. QUESTION: 146 A user has launched an EC2 instance from an instance store backed AMI. The infrastructure team wants to create an AMI from the running instance. Which of the below mentioned steps will not be performed while creating the AMI? A. Define the AMI launch permissions B. Upload the bundled volume C. Register the AMI D. Bundle the volume AWS-SysOps 74http://www.examarea.comhttp://www.fravo.com Answer: A Explanation: When the user has launched an EC2 instance from an instance store backed AMI, it will need to follow certain steps, such as “Bundling the root volume”, “Uploading the bundled volume” and “Register the AMI”. Once the AMI is created the user can setup the launch permission. However, it is not required to setup during the launch. QUESTION: 147 You are managing the AWS account of a big organization. The organization has more than 1000+ employees and they want to provide access to the various services to most of the employees. Which of the below mentioned options is the best possible solution in this case? A. The user should create a separate IAM user for each employee and provide access to them as per the policy B. The user should create an IAM role and attach STS with the role. The user should attach that role to the EC2 instance and setup AWS authentication on that server C. The user should create IAM groups as per the organization’s departments and add each user to the group for better access control D. Attach an IAM role with the organization’s authentication service to authorize each user for various AWS services Answer: D Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. The user is managing an AWS account for an organization that already has an identity system, such as the login system for the corporate network (SSO.. In this case, instead of creating individual IAM users or groups for each user who need AWS access, it may be more practical to use a ***** server to translate the user identities from the organization network into the temporary AWS security credentials. This ***** server will attach an IAM role to the user after authentication. QUESTION: 148 A user has configured a VPC with a new subnet. The user has created a security group. The user wants to configure that instances of the same subnet communicate with each other. How can the user configure this with the security group? AWS-SysOps 75http://www.examarea.comhttp://www.fravo.com A. There is no need for a security group modification as all the instances can communicate with each other inside the same subnet B. Configure the subnet as the source in the security group and allow traffic on all the protocols and ports C. Configure the security group itself as the source and allow traffic on all the protocols and ports D. The user has to use VPC peering to configure this Answer: C Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. AWS provides two features that the user can use to increase security in VPC: security groups and network ACLs. Security groups work at the instance level. If the user is using the default security group it will have a rule which allows the instances to communicate with other. For a new security group the user has to specify the rule, add it to define the source as the security group itself, and select all the protocols and ports for that source. QUESTION: 149 A user is launching an instance. He is on the “Tag the instance” screen. Which of the below mentioned information will not help the user understand the functionality of an AWS tag? A. Each tag will have a key and value B. The user can apply tags to the S3 bucket C. The maximum value of the tag key length is 64 unicode characters D. AWS tags are used to find the cost distribution of various resources Answer: C Explanation: AWS provides cost allocation tags to categorize and track the AWS costs. When the user applies tags to his AWS resources, AWS generates a cost allocation report as a comma-separated value (CSV file. with the usage and costs aggregated by those tags. Each tag will have a key-value and can be applied to services, such as EC2, S3, RDS, EMR, etc. The maximum size of a tag key is 128 unicode characters. QUESTION: 150 AWS-SysOps 76http://www.examarea.comhttp://www.fravo.com A user has created a VPC with CIDR 20.0.0.0/16. The user has created public and VPN only subnets along with hardware VPN access to connect to the user’s datacenter. The user wants to make so that all traffic coming to the public subnet follows the organization’s ***** policy. How can the user make this happen? A. Setting up a NAT with the ***** protocol and configure that the public subnet receives traffic from NAT B. Settin up a ***** policy in the internet gateway connected with the public subnet C. It is not possible to setup the ***** policy for a public subnet D. Setting the route table and security group of the public subnet which receives traffic from a virtual private gateway Answer: D Explanation: The user can create subnets within a VPC. If the user wants to connect to VPC from his own data centre, he can setup public and VPN only subnets which uses hardware VPN access to connect with his data centre. When the user has configured this setup, it will update the main route table used with the VPN-only subnet, create a custom route table and associate it with the public subnet. It also creates an internet gateway for the public subnet. By default the internet traffic of the VPN subnet is routed to a virtual private gateway while the internet traffic of the public subnet is routed through the internet gateway. The user can set up the route and security group rules. These rules enable the traffic to come from the organization’s network over the virtual private gateway to the public subnet to allow ***** settings on that public subnet. QUESTION: 151 A user has created a VPC with CIDR 20.0.0.0/24. The user has created a public subnet with CIDR 20.0.0.0/25 and a private subnet with CIDR 20.0.0.128/25. The user has launched one instance each in the private and public subnets. Which of the below mentioned options cannot be the correct IP address (private IP. assigned to an instance in the public or private subnet? A. 20.0.0.255 B. 20.0.0.132 C. 20.0.0.122 D. 20.0.0.55 Answer: A Explanation: AWS-SysOps 77http://www.examarea.comhttp://www.fravo.com When the user creates a subnet in VPC, he specifies the CIDR block for the subnet. In this case the user has created a VPC with the CIDR block 20.0.0.0/24, which supports 256 IP addresses (20.0.0.0 to 20.0.0.255.. The public subnet will have IP addresses between 20.0.0.0 - 20.0.0.127 and the private subnet will have IP addresses between 20.0.0.128 - 20.0.0.255. AWS reserves the first four IP addresses and the last IP address in each subnet’s CIDR block. These are not available for the user to use. Thus, the instance cannot have an IP address of 20.0.0.255 QUESTION: 152 A user has launched an EBS backed EC2 instance. The user has rebooted the instance. Which of the below mentioned statements is not true with respect to the reboot action? A. The private and public address remains the same B. The Elastic IP remains associated with the instance C. The volume is preserved D. The instance runs on a new host computer Answer: D Explanation: A user can reboot an EC2 instance using the AWS console, the Amazon EC2 CLI or the Amazon EC2 API. Rebooting an instance is equivalent to rebooting an operating system. However, it is recommended that the user use the Amazon EC2 to reboot the instance instead of running the operating system reboot command from the instance. The instance remains on the same host computer and maintains its public DNS name, private IP address, and any data on its instance store volumes. It typically takes a few minutes for the reboot to complete, but the time it takes to reboot depends on the instance configuration. QUESTION: 153 A user has setup a web application on EC2. The user is generating a log of the application performance at every second. There are multiple entries for each second. If the user wants to send that data to CloudWatch every minute, what should he do? A. The user should send only the data of the 60th second as CloudWatch will map the receive data timezone with the sent data timezone B. It is not possible to send the custom metric to CloudWatch every minute C. Give CloudWatch the Min, Max, Sum, and SampleCount of a number of every minute D. Calculate the average of one minute and send the data to CloudWatch AWS-SysOps 78http://www.examarea.comhttp://www.fravo.com Answer: C Explanation: Amazon CloudWatch aggregates statistics according to the period length that the user has specified while getting data from CloudWatch. The user can publish as many data points as he wants with the same or similartime stamps. CloudWatch aggregates them by the period length when the user calls get statistics about those data points. CloudWatch records the average (sum of all items divided by the number of items. of the values received for every 1-minute period, as well as the number of samples, maximum value, and minimum value for the same time period. CloudWatch will aggregate all the data which have time stamps within a one-minute period. QUESTION: 154 An AWS root account owner is trying to create a policy to access RDS. Which of the below mentioned statements is true with respect to the above information? A. Create a policy which allows the users to access RDS and apply it to the RDS instances B. The user cannot access the RDS database if he is not assigned the correct IAM policy C. The root account owner should create a policy for the IAM user and give him access to the RDS services D. The policy should be created for the user and provide access for RDS Answer: C Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. If the account owner wants to create a policy for RDS, the owner has to create an IAM user and define the policy which entitles the IAM user with various RDS services such as Launch Instance, Manage security group, Manage parameter group etc. QUESTION: 155 A user is using a small MySQL RDS DB. The user is experiencing high latency due to the Multi AZ feature.Which of the below mentioned options may not help the user in this situation? A. Schedule the automated back up in non-working hours B. Use a large or higher size instance AWS-SysOps 79http://www.examarea.comhttp://www.fravo.com C. Use PIOPS D. Take a snapshot from standby Replica Answer: D Explanation: An RDS DB instance which has enabled Multi AZ deployments may experience increased write and commit latency compared to a Single AZ deployment, due to synchronous data replication. The user may also face changes in latency if deployment fails over to the standby replica. For production workloads, AWS recommends the user to use provisioned IOPS and DB instance classes (m1.large and larger. as they are optimized for provisioned IOPS to give a fast, and consistent performance. With Multi AZ feature, the user can not have option to take snapshot from replica. QUESTION: 156 A user is displaying the CPU utilization, and Network in and Network out CloudWatch metrics data of a single instance on the same graph. The graph uses one Y-axis for CPU utilization and Network in and another Y-axis for Network out. Since Network in is too high, the CPU utilization data is not visible clearly on graph to the user. How can the data be viewed better on the same graph? A. It is not possible to show multiple metrics with the different units on the same graph B. Add a third Y-axis with the console to show all the data in proportion C. Change the axis of Network by using the Switch command from the graph D. Change the units of CPU utilization so it can be shown in proportion with Network Answer: C Explanation: Amazon CloudWatch provides the functionality to graph the metric data generated either by the AWS services or the custom metric to make it easier for the user to analyse. It is possible to show the multiple metrics with different units on the same graph. If the graph is not plotted properly due to a difference in the unit data over two metrics, the user can change the Y-axis of one of the graph by selecting that graph and clicking on the Switch option. QUESTION: 157 A user is planning to use AWS services for his web application. If the user is trying to set up his own billing management system for AWS, how can he configure it? AWS-SysOps 80http://www.examarea.comhttp://www.fravo.com A. Set up programmatic billing access. Download and parse the bill as per the requirement B. It is not possible for the user to create his own billing management service with AWS C. Enable the AWS CloudWatch alarm which will provide APIs to download the alarm data D. Use AWS billing APIs to download the usage report of each service from the AWS billing console Answer: A Explanation: WS provides an option to have programmatic access to billing. Programmatic Billing Access leverages the existing Amazon Simple Storage Service (Amazon S3. APIs. Thus, the user can build applications that reference his billing data from a CSV (comma-separated value. file stored in an Amazon S3 bucket. AWS will upload the bill to the bucket every few hours and the user can download the bill CSV from the bucket, parse itand create a billing system as per the requirement. QUESTION: 158 A user is planning to schedule a backup for an EBS volume. The user wants security of the snapshot data. How can the user achieve data encryption with a snapshot? A. Use encrypted EBS volumes so that the snapshot will be encrypted by AWS B. While creating a snapshot select the snapshot with encryption C. By default the snapshot is encrypted by AWS D. Enable server side encryption for the snapshot using S3 Answer: A Explanation: AWS EBS supports encryption of the volume. It also supports creating volumes from existing snapshots provided the snapshots are created from encrypted volumes. The data at rest, the I/O as well as all the snapshots of the encrypted EBS will also be encrypted. EBS encryption is based on the AES-256 cryptographic algorithm, which is the industry standard. QUESTION: 159 A user has created a public subnet with VPC and launched an EC2 instance within it. The user is trying to delete the subnet. What will happen in this scenario? AWS-SysOps 81http://www.examarea.comhttp://www.fravo.com A. It will delete the subnet and make the EC2 instance as a part of the default subnet B. It will not allow the user to delete the subnet until the instances are terminated C. It will delete the subnet as well as terminate the instances D. The subnet can never be deleted independently, but the user has to delete the VPC first Answer: B Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. When an instance is launched it will have a network interface attached with it. The user cannot delete the subnet until he terminates the instance and deletes the network interface. QUESTION: 160 A user has setup an EBS backed instance and attached 2 EBS volumes to it. The user has setup a CloudWatch alarm on each volume for the disk data. The user has stopped the EC2 instance and detached the EBS volumes. What will be the status of the alarms on the EBS volume? A. OK B. Insufficient Data C. Alarm D. The EBS cannot be detached until all the alarms are removed Answer: B Explanation: Amazon CloudWatch alarm watches a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. Alarms invoke actions only for sustained state changes. There are three states of the alarm: OK, Alarm and Insufficient data. In this case since the EBS is detached and inactive the state will be Insufficient. QUESTION: 161 A user has launched an EC2 instance from an instance store backed AMI. The infrastructure team wants to create an AMI from the running instance. Which of the below mentioned credentials is not required while creating the AMI? AWS-SysOps 82http://www.examarea.comhttp://www.fravo.com A. AWS account ID B. X.509 certificate and private key C. AWS login ID to login to the console D. Access key and secret access key Answer: C Explanation: When the user has launched an EC2 instance from an instance store backed AMI and the admin team wants to create an AMI from it, the user needs to setup the AWS AMI or the API tools first. Once the tool is setup the user will need the following credentials: AWS account ID; AWS access and secret access key; X.509 certificate with private key. QUESTION: 162 A user has configured an SSL listener at ELB as well as on the back-end instances. Which of the below mentioned statements helps the user understand ELB traffic handling with respect to the SSL listener? A. It is not possible to have the SSL listener both at ELB and back-end instances B. ELB will modify headers to add requestor details C. ELB will intercept the request to add the cookie details if sticky session is enabled D. ELB will not modify the headers Answer: D Explanation: When the user has configured Transmission Control Protocol (TCP. or Secure Sockets Layer (SSL. for both front-end and back-end connections of the Elastic Load Balancer, the load balancer forwards the request to the back-end instances without modifying the request headers unless the ***** header is enabled. SSL does not support sticky sessions. If the user has enabled a ***** protocol it adds the source and destination IP to the header. QUESTION: 163 A user has created a Cloudformation stack. The stack creates AWS services, such as EC2 instances, ELB, AutoScaling, and RDS. While creating the stack it created EC2, ELB and AutoScaling but failed to create RDS. What will Cloudformation do in this scenario? AWS-SysOps 83http://www.examarea.comhttp://www.fravo.com A. Cloudformation can never throw an error after launching a few services since it verifies all the steps before launching B. It will warn the user about the error and ask the user to manually create RDS C. Rollback all the changes and terminate all the created services D. It will wait for the user’s input about the error and correct the mistake after the input Answer: C Explanation: AWS Cloudformation is an application management tool which provides application modelling, deployment, configuration, management and related activities. The AWS Cloudformation stack is a collection of AWS resources which are created and managed as a single unit when AWS CloudFormation instantiates a template. If any of the services fails to launch, Cloudformation will rollback all the changes and terminate or delete all the created services. QUESTION: 164 A user is trying to launch an EBS backed EC2 instance under free usage. The user wants to achieve encryption of the EBS volume. How can the user encrypt the data at rest? A. Use AWS EBS encryption to encrypt the data at rest B. The user cannot use EBS encryption and has to encrypt the data manually or using a third party tool C. The user has to select the encryption enabled flag while launching the EC2 instance D. Encryption of volume is not available as a part of the free usage tier Answer: B Explanation: AWS EBS supports encryption of the volume while creating new volumes. It supports encryption of the data at rest, the I/O as well as all the snapshots of the EBS volume. The EBS supports encryption for the selected instance type and the newer generation instances, such as m3, c3, cr1, r3, g2. It is not supported with a micro instance. QUESTION: 165 A user has created a VPC with public and private subnets using the VPC wizard. The user has not launched any instance manually and is trying to delete the VPC. What will happen in this scenario? AWS-SysOps 84http://www.examarea.comhttp://www.fravo.com A. It will not allow to delete the VPC as it has subnets with route tables B. It will not allow to delete the VPC since it has a running route instance C. It will terminate the VPC along with all the instances launched by the wizard D. It will not allow to delete the VPC since it has a running NAT instance Answer: D Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet, the instances in the public subnet can receive inbound traffic directly from the Internet, whereas the instances in the private subnet cannot. If these subnets are created with Wizard, AWS will create a NAT instance with an elastic IP. If the user is trying to delete the VPC it will not allow as the NAT instance is still running. QUESTION: 166 An organization is measuring the latency of an application every minute and storing data inside a file in the JSON format. The organization wants to send all latency data to AWS CloudWatch. How can the organization achieve this? A. The user has to parse the file before uploading data to CloudWatch B. It is not possible to upload the custom data to CloudWatch C. The user can supply the file as an input to the CloudWatch command D. The user can use the CloudWatch Import command to import data from the file to CloudWatch Answer: C Explanation: AWS CloudWatch supports the custom metrics. The user can always capture the custom data and upload the data to CloudWatch using CLI or APIs. The user has to always include the namespace as part of the request. If the user wants to upload the custom data from a file, he can supply file name along with the parameter -- metric-data to command put-metric-data. QUESTION: 167 A user has launched an EBS backed instance with EC2-Classic. The user stops and starts the instance. Which of the below mentioned statements is not true with respect to AWS-SysOps 85http://www.examarea.comhttp://www.fravo.com the stop/start action? A. The instance gets new private and public IP addresses B. The volume is preserved C. The Elastic IP remains associated with the instance D. The instance may run on a anew host computer Answer: C Explanation: A user can always stop/start an EBS backed EC2 instance. When the user stops the instance, it first enters the stopping state, and then the stopped state. AWS does not charge the running cost but charges only for the EBS storage cost. If the instance is running in EC2-Classic, it receives a new private IP address; as the Elastic IP address (EIP. associated with the instance is no longer associated with that instance. QUESTION: 168 A user has launched an RDS postgreSQL DB with AWS. The user did not specify the maintenance window during creation. The user has configured RDS to update the DB instance type from micro to large. If the user wants to have it during the maintenance window, what will AWS do? A. AWS will not allow to update the DB until the maintenance window is configured B. AWS will select the default maintenance window if the user has not provided it C. AWS will ask the user to specify the maintenance window during the update D. It is not possible to change the DB size from micro to large with RDS Answer: B Explanation: AWS RDS has a compulsory maintenance window which by default is 30 minutes. If the user does not specify the maintenance window during the creation of RDS then AWS will select a 30-minute maintenance window randomly from an 8-hour block of time per region. In this case, Amazon RDS assigns a 30-minute maintenance window on a randomly selected day of the week. QUESTION: 169 A user has created a subnet in VPC and launched an EC2 instance within it. The user has not selected the option to assign the IP address while launching the instance. The user has 3 elastic IPs and is trying to assign one of the Elastic IPs to the VPC instance AWS-SysOps 86http://www.examarea.comhttp://www.fravo.com from the console. The console does not show any instance in the IP assignment screen. What is a possible reason that the instance is unavailable in the assigned IP console? A. The IP address may be attached to one of the instances B. The IP address belongs to a different zone than the subnet zone C. The user has not created an internet gateway D. The IP addresses belong to EC2 Classic; so they cannot be assigned to VPC Answer: D Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. When the user is launching an instance he needs toselect an option which attaches a public IP to the instance. If the user has not selected the option to attach the public IP then it will only have a private IP when launched. If the user wants to connect to an instance from the internet he should create an elastic IP with VPC. If the elastic IP is a part of EC2 Classic it cannot be assigned to a VPC instance. QUESTION: 170 A user has launched multiple EC2 instances for the purpose of development and testing in the same region. The user wants to find the separate cost for the production and development instances. How can the user find the cost distribution? A. The user should download the activity report of the EC2 services as it has the instance ID wise data B. It is not possible to get the AWS cost usage data of single region instances separately C. The user should use Cost Distribution Metadata and AWS detailed billing D. The user should use Cost Allocation Tags and AWS billing reports Answer: D Explanation: AWS provides cost allocation tags to categorize and track the AWS costs. When the user applies tags to his AWS resources (such as Amazon EC2 instances or Amazon S3 buckets., AWS generates a cost allocation report as a comma-separated value (CSV file. with the usage and costs aggregated by those tags. The user can apply tags which represent business categories (such as cost centres, application names, or instance type – Production/Dev. to organize usage costs across multiple services. AWS-SysOps 87http://www.examarea.comhttp://www.fravo.com QUESTION: 171 A user has created a VPC with CIDR 20.0.0.0/16 using VPC Wizard. The user has created a public CIDR (20.0.0.0/24. and a VPN only subnet CIDR (20.0.1.0/24. along with the hardware VPN access to connect to the user’s data centre. Which of the below mentioned components is not present when the VPC is setup with the wizard? A. Main route table attached with a VPN only subnet B. A NAT instance configured to allow the VPN subnet instances to connect with the internet C. Custom route table attached with a public subnet D. An internet gateway for a public subnet Answer: B Explanation: The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data centre, he can setup a public and VPN only subnet which uses hardware VPN access to connect with his data centre. When the user has configured this setup with Wizard, it will update the main route table used with the VPN-only subnet, create a custom route table and associate it with the public subnet. It also creates an internet gateway for the public subnet. The wizard does not create a NAT instance by default. The user can create it manually and attach it with a VPN only subnet. QUESTION: 172 A user has created a VPC with the public subnet. The user has created a security group for that VPC. Which of the below mentioned statements is true when a security group is created? A. It can connect to the AWS services, such as S3 and RDS by default B. It will have all the inbound traffic by default C. It will have all the outbound traffic by default D. It will by default allow traffic to the internet gateway Answer: C Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. AWS provides two features the user can use to increase security in VPC: security groups and network ACLs. Security groups work at the instance level while ACLs work at the subnet level. When a user creates a security group with AWS VPC, AWS-SysOps 88http://www.examarea.comhttp://www.fravo.com by default it will allow all the outbound traffic but block all inbound traffic. QUESTION: 173 A user has setup an Auto Scaling group. The group has failed to launch a single instance for more than 24 hours. What will happen to Auto Scaling in this condition? A. Auto Scaling will keep trying to launch the instance for 72 hours B. Auto Scaling will suspend the scaling process C. Auto Scaling will start an instance in a separate region D. The Auto Scaling group will be terminated automatically Answer: B Explanation: If Auto Scaling is trying to launch an instance and if the launching of the instance fails continuously, it will suspend the processes for the Auto Scaling groups since it repeatedly failed to launch an instance. This is known as an administrative suspension. It commonly applies to the Auto Scaling group that has no running instances which is trying to launch instances for more than 24 hours, and has not succeeded in that to do so. QUESTION: 174 A user is planning to set up the Multi AZ feature of RDS. Which of the below mentioned conditions won't take advantage of the Multi AZ feature? A. Availability zone outage B. A manual failover of the DB instance using Reboot with failover option C. Region outage D. When the user changes the DB instance’s server type Answer: C Explanation: Amazon RDS when enabled with Multi AZ will handle failovers automatically. Thus, the user can resume database operations as quickly as possible without administrative intervention. The primary DB instance switches over automatically to the standby replica if any of the following conditions occur: An Availability Zone outage The primary DB instance fails The DB instance's server type is changed The DB instance is undergoing software patching AWS-SysOps 89http://www.examarea.comhttp://www.fravo.com A manual failover of the DB instance was initiated using Reboot with failover QUESTION: 175 An organization has configured Auto Scaling with ELB. One of the instance health check returns the status as Impaired to Auto Scaling. What will Auto Scaling do in this scenario? A. Perform a health check until cool down before declaring that the instance has failed B. Terminate the instance and launch a new instance C. Notify the user using SNS for the failed state D. Notify ELB to stop sending traffic to the impaired instance Answer: B Explanation: The Auto Scaling group determines the health state of each instance periodically by checking the results of the Amazon EC2 instance status checks. If the instance status description shows any other state other than “running” or the system status description shows impaired, Auto Scaling considers the instance to be unhealthy. Thus, it terminates the instance and launches a replacement. QUESTION: 176 A user is using Cloudformation to launch an EC2 instance and then configure an application after the instance is launched. The user wants the stack creation of ELB and AutoScaling to wait until the EC2 instance is launched and configured properly. How can the user configure this? A. It is not possible that the stack creation will wait until one service is created and launched B. The user can use the HoldCondition resource to wait for the creation of the other dependent resources C. The user can use the DependentCondition resource to hold the creation of the other dependent resources D. The user can use the WaitCondition resource to hold the creation of the other dependent resources Answer: D Explanation: AWS Cloudformation is an application management tool which provides application AWS-SysOps 90http://www.examarea.comhttp://www.fravo.com modelling, deployment, configuration, management and related activities. AWS CloudFormation provides a WaitCondition resource which acts as a barrier and blocks the creation of other resources until a completion signal is received from an external source, such as a user application or management system. QUESTION: 177 An organization has configured two single availability zones. The Auto Scaling groups are configured in separate zones. The user wants to merge the groups such that one group spans across multiple zones. How can the user configure this? A. Run the command as-join-auto-scaling-group to join the two groups B. Run the command as-update-auto-scaling-group to configure one group to span across zones and delete the other group C. Run the command as-copy-auto-scaling-group to join the two groups D. Run the command as-merge-auto-scaling-group to merge the groups Answer: B Explanation: If the user has configured two separate single availability zone Auto Scaling groups and wants to merge them then he should update one of the groups and delete the other one. While updating the first group it is recommended that the user should increase the size of the minimum, maximum and desired capacity as a summation of both the groups. QUESTION: 178 An AWS account wants to be part of the consolidated billing of his organization’s payee account. How can the owner of that account achieve this? A. The payee account has to request AWS support to link the other accounts with his account B. The owner of the linked account should add the payee account to his master account list from the billing console C. The payee account will send a request to the linked account to be a part of consolidated billing D. The owner of the linked account requests the payee account to add his account to consolidated billing Answer: C Explanation: AWS-SysOps 91http://www.examarea.comhttp://www.fravo.com AWS consolidated billing enables the organization to consolidate payments for multiple Amazon Web Services (AWS. accounts within a single organization by making a single paying account. To add a particular account (linked. to the master (payee. account, the payee account has to request the linked account to join consolidated billing. Once the linked account accepts the request henceforth all charges incurred by the linked account will be paid by the payee account. QUESTION: 179 A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. What does this policy define? "Statement": [{ "Sid": "Stmt1388811069831", "Effect": "Allow", "Principal": { "AWS": "*"}, "Action": [ "s3:GetObjectAcl", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::cloudacademy] }] A. It will make the cloudacademy bucket as well as all its objects as public B. It will allow everyone to view the ACL of the bucket C. It will give an error as no object is defined as part of the policy while the action defines the rule about the object D. It will make the cloudacademy bucket as public Answer: D Explanation: A sysadmin can grant permission to the S3 objects or the buckets to any user or make objects public using the bucket policy and user policy. Both use the JSON-based access policy language. Generally if the user is defining the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be defined at the bucket level which allows the objects as well as the bucket to be public with a single policy applied to that bucket. In the sample policy the action says “S3:ListBucket” for effect Allow on Resource arn:aws:s3:::cloudacademy. This will make the cloudacademy bucket public. "Statement": [{ "Sid": "Stmt1388811069831", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "s3:GetObjectAcl", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::cloudacademy] }] AWS-SysOps 92http://www.examarea.comhttp://www.fravo.com QUESTION: 180 A user has launched two EBS backed EC2 instances in the US-East-1a region. The user wants to change the zone of one of the instances. How can the user change it? A. The zone can only be modified using the AWS CLI B. It is not possible to change the zone of an instance after it is launched C. Stop one of the instances and change the availability zone D. From the AWS EC2 console, select the Actions - > Change zones and specify the new zone Answer: B Explanation: With AWS EC2, when a user is launching an instance he can select the availability zone (AZ. at the time of launch. If the zone is not selected, AWS selects it on behalf of the user. Once the instance is launched, the user cannot change the zone of that instance unless he creates an AMI of that instance and launches a new instance from it. QUESTION: 181 An organization (account ID 123412341234. has configured the IAM policy to allow the user to modify his credentials. What will the below mentioned statement allow the user to perform? { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:GetGroup" ], "Resource": "arn:aws:iam:: 123412341234:group/TestingGroup" }] A. The IAM policy will throw an error due to an invalid resource name B. The IAM policy will allow the user to subscribe to any IAM group C. Allow the IAM user to update the membership of the group called TestingGroup D. Allow the IAM user to delete the TestingGroup Answer: C Explanation: AWS Identity and Access Management is a web service which allows organizations to AWS-SysOps 93http://www.examarea.comhttp://www.fravo.com manage users and user permissions for various AWS services. If the organization (account ID 123412341234. wants their users to manage their subscription to the groups, they should create a relevant policy for that. The below mentioned policy allows the respective IAM user to update the membership of the group called MarketingGroup. { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:GetGroup" ], "Resource": "arn:aws:iam:: 123412341234:group/ TestingGroup " }] QUESTION: 182 A user has configured ELB with two EBS backed instances. The user has stopped the instances for 1 week to save costs. The user restarts the instances after 1 week. Which of the below mentioned statements will help the user to understand the ELB and instance registration better? A. There is no way to register the stopped instances with ELB B. The user cannot stop the instances if they are registered with ELB C. If the instances have the same Elastic IP assigned after reboot they will be registered with ELB D. The instances will automatically get registered with ELB Answer: C Explanation: Elastic Load Balancing registers the user’s load balancer with his EC2 instance using the associated IP address. When the instances are stopped and started back they will have a different IP address. Thus, they will not get registered with ELB unless the user manually registers them. If the instances are assigned the same Elastic IP after reboot they will automatically get registered with ELB. QUESTION: 183 A user is trying to connect to a running EC2 instance using SSH. However, the user gets a Host key not found error. Which of the below mentioned options is a possible reason for rejection? A. The user has provided the wrong user name for the OS login AWS-SysOps 94http://www.examarea.comhttp://www.fravo.com B. The instance CPU is heavily loaded C. The security group is not configured properly D. The access key to connect to the instance is wrong Answer: A Explanation: If the user is trying to connect to a Linux EC2 instance and receives the Host Key not found error the probable reasons are: The private key pair is not right The user name to login is wrong QUESTION: 184 A user has hosted an application on EC2 instances. The EC2 instances are configured with ELB and Auto Scaling. The application server session time out is 2 hours. The user wants to configure connection draining to ensure that all in-flight requests are supported by ELB even though the instance is being deregistered. What time out period should the user specify for connection draining? A. 5 minutes B. 1 hour C. 30 minutes D. 2 hours Answer: B QUESTION: 185 A user is using the AWS EC2. The user wants to make so that when there is an issue in the EC2 server, such as instance status failed, it should start a new instance in the user’s private cloud. Which AWS service helps to achieve this automation? A. AWS CloudWatch + Cloudformation B. AWS CloudWatch + AWS AutoScaling + AWS ELB C. AWS CloudWatch + AWS VPC D. AWS CloudWatch + AWS SNS Answer: D Explanation: Amazon SNS can deliver notifications by SMS text message or email to the Amazon AWS-SysOps 95http://www.examarea.comhttp://www.fravo.com Simple Queue Service (SQS. queues or to any HTTP endpoint. The user can configure a web service (HTTP End point. in his data centre which receives data and launches an instance in the private cloud. The user should configure the CloudWatch alarm to send a notification to SNS when the “StatusCheckFailed” metric is true for the EC2 instance. The SNS topic can be configured to send a notification to the user’s HTTP end point which launches an instance in the private cloud. QUESTION: 186 A sys admin has enabled logging on ELB. Which of the below mentioned fields will not be a part of the log file name? A. Load Balancer IP B. EC2 instance IP C. S3 bucket name D. Random string Answer: B Explanation: Elastic Load Balancing access logs capture detailed information for all the requests made to the load balancer. Elastic Load Balancing publishes a log file from each load balancer node at the interval that the user has specified. The load balancer can deliver multiple logs for the same period. Elastic Load Balancing creates log file names in the following format: “{Bucket}/{Prefix}/AWSLogs/{AWS AccountID}/elasticloadbalancing/{Region}/{Year}/{Month}/{Day}/{AWS Account ID}_elasticloadbalancing_{Region}_{Load Balancer Name}_{End Time}_{Load Balancer IP}_{Random String}.log“ QUESTION: 187 A user has created a queue named “awsmodule” with SQS. One of the consumers of queue is down for 3 days and then becomes available. Will that component receive message from queue? A. Yes, since SQS by default stores message for 4 days B. No, since SQS by default stores message for 1 day only C. No, since SQS sends message to consumers who are available that time D. Yes, since SQS will not delete message until it is delivered to all consumers Answer: A AWS-SysOps 96http://www.examarea.comhttp://www.fravo.com Explanation: SQS allows the user to move data between distributed components of applications so they can perform different tasks without losing messages or requiring each component to be always available. Queues retain messages for a set period of time. By default, a queue retains messages for four days. However, the user can configure a queue to retain messages for up to 14 days after the message has been sent. QUESTION: 188 An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achieve this? A. Create an IAM policy with the security group and use that security group for AWS console login B. Create an IAM policy with a condition which denies access when the IP address range is not from the organization C. Configure the EC2 instance security group which allows traffic only from the organization’s IP range D. Create an IAM policy with VPC and allow a secure gateway between the organization and AWS Console Answer: B Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. The user can add conditions as a part of the IAM policies. The condition can be set on AWS Tags, Time, and Client IP as well as on many other parameters. If the organization wants the user to access only from a specific IP range, they should set an IAM policy condition which denies access when the IP is not in a certain range. E.g. The sample policy given below denies all traffic when the IP is not in a certain range. "Statement": [{ "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "NotIpAddress": { "aws:SourceIp": ["10.10.10.0/24", "20.20.30.0/24"] } } }] QUESTION: 189 An organization has created one IAM user and applied the below mentioned policy to AWS-SysOps 97http://www.examarea.comhttp://www.fravo.com the user. What entitlements do the IAM users avail with this policy? { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:Describe*", "Resource": "*" }, { "Effect": "Allow" "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:Describe*", "Resource": "*" } ] } A. The policy will allow the user to perform all read only activities on the EC2 services B. The policy will allow the user to list all the EC2 resources except EBS C. The policy will allow the user to perform all read and write activities on the EC2 services D. The policy will allow the user to perform all read only activities on the EC2 services except load Balancing Answer: D Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. If an organization wants to setup read only access to EC2 for a particular user, they should mention the action in the IAM policy which entitles the user for Describe rights for EC2, CloudWatch, Auto Scaling and ELB. In the policy shown below, the user will have read only access for EC2 and EBS, CloudWatch and Auto Scaling. Since ELB is not mentioned as a part of the list, the user will not have access to ELB. { "Version": "2012-10-17", "Statement": [ AWS-SysOps 98http://www.examarea.comhttp://www.fravo.com { "Effect": "Allow", "Action": "ec2:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "cloudwatch:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "autoscaling:Describe*", "Resource": "*" } ] } QUESTION: 190 A user has enabled session stickiness with ELB. The user does not want ELB to manage the cookie; instead he wants the application to manage the cookie. What will happen when the server instance, which is bound to a cookie, crashes? A. The response will have a cookie but stickiness will be deleted B. The session will not be sticky until a new cookie is inserted C. ELB will throw an error due to cookie unavailability D. The session will be sticky and ELB will route requests to another server as ELB keeps replicating the Cookie Answer: B Explanation: With Elastic Load Balancer, if the admin has enabled a sticky session with application controlled stickiness, the load balancer uses a special cookie generated by the application to associate the session with the original server which handles the request. ELB follows the lifetime of the application-generated cookie corresponding to the cookie name specified in the ELB policy configuration. The load balancer only inserts a new stickiness cookie if the application response includes a new application cookie. The load balancer stickiness cookie does not update with each request. If the application cookie is explicitly removed or expires, the session stops being sticky until a new application cookie is issued. QUESTION: 191 AWS-SysOps 99http://www.examarea.comhttp://www.fravo.com A user is observing the EC2 CPU utilization metric on CloudWatch. The user has observed some interesting patterns while filtering over the 1 week period for a particular hour. The user wants to zoom that data point to a more granular period. How can the user do that easily with CloudWatch? A. The user can zoom a particular period by selecting that period with the mouse and then releasing the mouse B. The user can zoom a particular period by double clicking on that period with the mouse C. The user can zoom a particular period by specifying the aggregation data for that period D. The user can zoom a particular period by specifying the period in the Time Range Answer: A QUESTION: 192 A user has created an Auto Scaling group with default configurations from CLI. The user wants to setup the CloudWatch alarm on the EC2 instances, which are launched by the Auto Scaling group. The user has setup an alarm to monitor the CPU utilization every minute. Which of the below mentioned statements is true? A. It will fetch the data at every minute but the four data points [corresponding to 4 minutes] will not have value since the EC2 basic monitoring metrics are collected every five minutes B. It will fetch the data at every minute as detailed monitoring on EC2 will be enabled by the default launch configuration of Auto Scaling C. The alarm creation will fail since the user has not enabled detailed monitoring on the EC2 instances D. The user has to first enable detailed monitoring on the EC2 instances to support alarm monitoring at every minute Answer: B Explanation: CloudWatch is used to monitor AWS as well as the custom services. To enable detailed instance monitoring for a new Auto Scaling group, the user does not need to take any extra steps. When the user creates an Auto Scaling launch config using CLI, each launch configuration contains a flag named InstanceMonitoring.Enabled. The default value of this flag is true. Thus, by default detailed monitoring will be enabled for Auto Scaling as well as for all the instances launched by that Auto Scaling group. AWS-SysOps 100http://www.examarea.comhttp://www.fravo.com QUESTION: 193 A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is not true in this scenario? A. The VPC will create a routing instance and attach it with a public subnet B. The VPC will create two subnets C. The VPC will create one internet gateway and attach it to VPC D. The VPC will launch one NAT instance with an elastic IP Answer: A Explanation: A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet, the instances in the public subnet can receive inbound traffic directly from the internet, whereas the instances in the private subnet cannot. If these subnets are created with Wizard, AWS will create a NAT instance with an elastic IP. Wizard will also create two subnets with route tables. It will also create an internet gateway and attach it to the VPC. QUESTION: 194 A user has configured ELB with a TCP listener at ELB as well as on the back-end instances. The user wants to enable a ***** protocol to capture the source and destination IP information in the header. Which of the below mentioned statements helps the user understand a ***** protocol with TCP configuration? A. If the end user is requesting behind a ***** server then the user should not enable a ***** protocol on ELB B. ELB does not support a ***** protocol when it is listening on both the load balancer and the back-end instances C. Whether the end user is requesting from a ***** server or directly, it does not make a difference for the ***** protocol D. If the end user is requesting behind the ***** then the user should add the “is*****” flag to the ELB Configuration Answer: A Explanation: When the user has configured Transmission Control Protocol (TCP. or Secure Sockets Layer (SSL. for both front-end and back-end connections of the Elastic Load Balancer, the load balancer forwards the request to the back-end instances without modifying the AWS-SysOps 101http://www.examarea.comhttp://www.fravo.com request headers unless the ***** header is enabled. If the end user is requesting from a ***** Protocol enabled ***** server, then the ELB admin should not enable the ***** Protocol on the load balancer. If the ***** Protocol is enabled on both the ***** server and the load balancer, the load balancer will add another header to the request which already has a header from the ***** server. This duplication may result in errors. QUESTION: 195 A user has launched 5 instances in EC2-CLASSIC and attached 5 elastic IPs to the five different instances in the US East region. The user is creating a VPC in the same region. The user wants to assign an elastic IP to the VPC instance. How can the user achieve this? A. The user has to request AWS to increase the number of elastic IPs associated with the account B. AWS allows 10 EC2 Classic IPs per region; so it will allow to allocate new Elastic IPs to the same region C. The AWS will not allow to create a new elastic IP in VPC; it will throw an error D. The user can allocate a new IP address in VPC as it has a different limit than EC2 Answer: D Explanation: Section: (none) A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. A user can have 5 IP addresses per region with EC2 Classic. The user can have 5 separate IPs with VPC in the same region as it has a separate limit than EC2 Classic. QUESTION: 196 A user has created a subnet in VPC and launched an EC2 instance within it. The user has not selected the option to assign the IP address while launching the instance. Which of the below mentioned statements is true with respect to this scenario? A. The instance will always have a public DNS attached to the instance by default B. The user can directly attach an elastic IP to the instance C. The instance will never launch if the public IP is not assigned D. The user would need to create an internet gateway and then attach an elastic IP to the instance to connect from internet Answer: D AWS-SysOps 102http://www.examarea.comhttp://www.fravo.com Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. When the user is launching an instance he needs to select an option which attaches a public IP to the instance. If the user has not selected the option to attach the public IP then it will only have a private IP when launched. The user cannot connect to the instance from the internet. If the user wants an elastic IP to connect to the instance from the internet he should create an internet gateway and assign an elastic IP to instance. QUESTION: 197 An organization has applied the below mentioned policy on an IAM group which has selected the IAM users. What entitlements do the IAM users avail with this policy? { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ] } A. The policy is not created correctly. It will throw an error for wrong resource name B. The policy is for the group. Thus, the IAM user cannot have any entitlement to this C. It allows full access to all AWS services for the IAM users who are a part of this group D. If this policy is applied to the EC2 resource, the users of the group will have full access to the EC2 Resources Answer: C Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. The IAM group allows the organization to specify permissions for a collection of users. With the below mentioned policy, it will allow the group full access (Admin. to all AWS services. { "Version": "2012-10-17", AWS-SysOps 103http://www.examarea.comhttp://www.fravo.com "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ] } QUESTION: 198 A user is configuring a CloudWatch alarm on RDS to receive a notification when the CPU utilization of RDS is higher than 50%. The user has setup an alarm when there is some inactivity on RDS, such as RDS unavailability. How can the user configure this? A. Setup the notification when the CPU is more than 75% on RDS B. Setup the notification when the state is Insufficient Data C. Setup the notification when the CPU utilization is less than 10% D. It is not possible to setup the alarm on RDS Answer: B Explanation: Amazon CloudWatch alarms watch a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The alarm has three states: Alarm, OK and Insufficient data. The Alarm will change to Insufficient Data when any of the three situations arise: when the alarm has just started, when the metric is not available or when enough data is not available for the metric to determine the alarm state. If the user wants to find that RDS is not available, he can setup to receive the notification when the state is in Insufficient data. QUESTION: 199 George has shared an EC2 AMI created in the US East region from his AWS account with Stefano. George copies the same AMI to the US West region. Can Stefano access the copied AMI of George’s account from the US West region? A. No, copy AMI does not copy the permission B. It is not possible to share the AMI with a specific account C. Yes, since copy AMI copies all private account sharing permissions D. Yes, since copy AMI copies all the permissions attached with the AMI AWS-SysOps 104http://www.examarea.comhttp://www.fravo.com Answer: A Explanation: Within EC2, when the user copies an AMI, the new AMI is fully independent of the source AMI; there is no link to the original (source. AMI. AWS does not copy launch the permissions, user- defined tags or the Amazon S3 bucket permissions from the source AMI to the new AMI. Thus, in this case by default Stefano will not have access to the AMI in the US West region. QUESTION: 200 A user has created a VPC with a subnet and a security group. The user has launched an instance in that subnet and attached a public IP. The user is still unable to connect to the instance. The internet gateway has also been created. What can be the reason for the error? A. The internet gateway is not configured with the route table B. The private IP is not present C. The outbound traffic on the security group is disabled D. The internet gateway is not configured with the security group Answer: A Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. AWS provides two features the user can use to increase security in VPC: security groups and network ACLs. Security groups work at the instance level. When a user launches an instance and wants to connect to an instance, he needs an internet gateway. The internet gateway should be configured with the route table to allow traffic from the internet. QUESTION: 201 A user is trying to setup a security policy for ELB. The user wants ELB to meet the cipher supported by the client by configuring the server order preference in ELB security policy. Which of the below mentioned preconfigured policies supports this feature? A. ELBSecurity Policy-2014-01 B. ELBSecurity Policy-2011-08 C. ELBDefault Negotiation Policy D. ELBSample- OpenSSLDefault Cipher Policy AWS-SysOps 105http://www.examarea.comhttp://www.fravo.com Answer: A Explanation: Elastic Load Balancing uses a Secure Socket Layer (SSL. negotiation configuration which is known as a Security Policy. It is used to negotiate the SSL connections between a client and the load balancer. If the load balancer is configured to support the Server Order Preference, then the load balancer gets to select the first cipher in its list that matches any one of the ciphers in the client's list. When the user verifies the preconfigured policies supported by ELB, the policy “ELBSecurity Policy-2014-01” supports server order preference. QUESTION: 202 A user has configured ELB with Auto Scaling. The user suspended the Auto Scaling AlarmNotification (which notifies Auto Scaling for CloudWatch alarms. process for a while. What will Auto Scaling do during this period? A. AWS will not receive the alarms from CloudWatch B. AWS will receive the alarms but will not execute the Auto Scaling policy C. Auto Scaling will execute the policy but it will not launch the instances until the process is resumed D. It is not possible to suspend the AlarmNotification process Answer: B Explanation: Auto Scaling performs various processes, such as Launch, Terminate Alarm Notification etc. The user can also suspend individual process. The AlarmNotification process type accepts notifications from the Amazon CloudWatch alarms that are associated with the Auto Scaling group. If the user suspends this process type, Auto Scaling will not automatically execute the scaling policies that would be triggered by the alarms. QUESTION: 203 George has launched three EC2 instances inside the US-East-1a zone with his AWS account. Ray has launched two EC2 instances in the US-East-1a zone with his AWS account. Which of the below entioned statements will help George and Ray understand the availability zone (AZ. concept better? A. The instances of George and Ray will be running in the same data centre AWS-SysOps 106http://www.examarea.comhttp://www.fravo.com B. All the instances of George and Ray can communicate over a private IP with a minimal cost C. All the instances of George and Ray can communicate over a private IP without any cost D. The US-East-1a region of George and Ray can be different availability zones Answer: D Explanation: Each AWS region has multiple, isolated locations known as Availability Zones. To ensure that the AWS resources are distributed across the Availability Zones for a region, AWS independently maps the Availability Zones to identifiers for each account. In this case the Availability Zone US-East-1a where George’s EC2 instances are running might not be the same location as the US-East-1a zone of Ray’s EC2 instances. There is no way for the user to coordinate the Availability Zones between accounts. QUESTION: 204 A user had aggregated the CloudWatch metric data on the AMI ID. The user observed some abnormal behaviour of the CPU utilization metric while viewing the last 2 weeks of data. The user wants to share that data with his manager. How can the user achieve this easily with the AWS console? A. The user can use the copy URL functionality of CloudWatch to share the exact details B. The user can use the export data option from the CloudWatch console to export the current data point C. The user has to find the period and data and provide all the aggregation information to the manager D. The user can use the CloudWatch data copy functionality to copy the current data points Answer: A Explanation: Amazon CloudWatch provides the functionality to graph the metric data generated either by the AWS services or the custom metric to make it easier for the user to analyse. The console provides the option to save the URL or bookmark it so that it can be used in the future by typing the same URL. The Copy URL functionality is available under the console when the user selects any metric to view. QUESTION: 205 AWS-SysOps 107http://www.examarea.comhttp://www.fravo.com A user has setup a CloudWatch alarm on the EC2 instance for CPU utilization. The user has setup to receive a notification on email when the CPU utilization is higher than 60%. The user is running a virus scan on the same instance at a particular time. The user wants to avoid receiving an email at this time. What should the user do? A. Remove the alarm B. Disable the alarm for a while using CLI C. Modify the CPU utilization by removing the email alert D. Disable the alarm for a while using the console Answer: B Explanation: Amazon CloudWatch alarm watches a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. When the user has setup an alarm and it is know that for some unavoidable event the status may change to Alarm, the user can disable the alarm using the DisableAlarmActions API or from the command line mondisable- alarm-actions. QUESTION: 206 A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned SSL protocols is not supported by the security policy? A. TLS 1.3 B. TLS 1.2 C. SSL 2.0 D. SSL 3.0 Answer: A Explanation: Elastic Load Balancing uses a Secure Socket Layer (SSL. negotiation configuration which is known as a Security Policy. It is used to negotiate the SSL connections between a client and the load balancer. Elastic Load Balancing supports the following versions of the SSL protocol: TLS 1.2 TLS 1.1 TLS 1.0 SSL 3.0 SSL 2.0 AWS-SysOps 108http://www.examarea.comhttp://www.fravo.com QUESTION: 207 A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306.. The user is configuring a security group for the public subnet (WebSecGrp. and the private subnet (DBSecGrp.. Which of the below mentioned entries is required in the private subnet database security group (DBSecGrp.? A. Allow Inbound on port 3306 for Source Web Server Security Group (WebSecGrp. B. Allow Inbound on port 3306 from source 20.0.0.0/16 C. Allow Outbound on port 3306 for Destination Web Server Security Group (WebSecGrp. D. Allow Outbound on port 80 for Destination NAT Instance IP Answer: A Explanation: A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet to host the web server and DB server respectively, the user should configure that the instances in the private subnet can receive inbound traffic from the public subnet on the DB port. Thus, configure port 3306 in Inbound with the source as the Web Server Security Group (WebSecGrp.. The user should configure ports 80 and 443 for Destination 0.0.0.0/0 as the route table directs traffic to the NAT instance from the private subnet. QUESTION: 208 A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created public and VPN only subnets along with hardware VPN access to connect to the user’s data centre. The user has not yet launched any instance as well as modified or deleted any setup. He wants to delete this VPC from the console. Will the console allow the user to delete the VPC? A. Yes, the console will delete all the setups and also delete the virtual private gateway B. No, the console will ask the user to manually detach the virtual private gateway first and then allow deleting the VPC C. Yes, the console will delete all the setups and detach the virtual private gateway D. No, since the NAT instance is running AWS-SysOps 109http://www.examarea.comhttp://www.fravo.com Answer: C Explanation: The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data centre, he can setup a public and VPN only subnet which uses hardware VPN access to connect with his data centre. When the user has configured this setup with Wizard, it will create a virtual private gateway to route all traffic of the VPN subnet. If the virtual private gateway is attached with VPC and the user deletes the VPC from the console it will first detach the gateway automatically and only then delete the VPC. QUESTION: 209 A user is trying to create a PIOPS EBS volume with 4000 IOPS and 100 GB size. AWS does not allow the user to create this volume. What is the possible root cause for this? A. The ratio between IOPS and the EBS volume is higher than 30 B. The maximum IOPS supported by EBS is 3000 C. The ratio between IOPS and the EBS volume is lower than 50 D. PIOPS is supported for EBS higher than 500 GB size Answer: A Explanation: A provisioned IOPS EBS volume can range in size from 10 GB to 1 TB and the user can provision up to 4000 IOPS per volume. The ratio of IOPS provisioned to the volume size requested should be a maximum of 30; for example, a volume with 3000 IOPS must be at least 100 GB. QUESTION: 210 A user has setup a custom application which generates a number in decimals. The user wants to track that number and setup the alarm whenever the number is above a certain limit. The application is sending the data to CloudWatch at regular intervals for this purpose. Which of the below mentioned statements is not true with respect to the above scenario? A. The user can get the aggregate data of the numbers generated over a minute and send it to CloudWatch B. The user has to supply the timezone with each data point C. CloudWatch will not truncate the number until it has an exponent larger than 126 (i.e. (1 x 10^126. D. The user can create a file in the JSON format with the metric name and value and AWS-SysOps 110http://www.examarea.comhttp://www.fravo.com supply it to CloudWatch Answer: B QUESTION: 211 A user has launched an EC2 Windows instance from an instance store backed AMI. The user has also set the Instance initiated shutdown behavior to stop. What will happen when the user shuts down the OS? A. It will not allow the user to shutdown the OS when the shutdown behaviour is set to Stop B. It is not possible to set the termination behaviour to Stop for an Instance store backed AMI instance C. The instance will stay running but the OS will be shutdown D. The instance will be terminated Answer: B Explanation: When the EC2 instance is launched from an instance store backed AMI, it will not allow the user to configure the shutdown behaviour to “Stop”. It gives a warning that the instance does not have the EBS root volume. QUESTION: 212 A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption (SSE-C., which of the below mentioned statements is true? A. The user should use the same encryption key for all versions of the same object B. It is possible to have different encryption keys for different versions of the same object C. AWS S3 does not allow the user to upload his own keys for server side encryption D. The SSE-C does not work when versioning is enabled Answer: B Explanation: AWS S3 supports client side or server side encryption to encrypt all data at rest. The server side encryption can either have the S3 supplied AES-256 encryption key or the AWS-SysOps 111http://www.examarea.comhttp://www.fravo.com user can send the key along with each API call to supply his own encryption key (SSEC.. If the bucket is versioning- enabled, each object version uploaded by the user using the SSE-C feature can have its own encryption key. The user is responsible for tracking which encryption key was used for which object's version QUESTION: 213 A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 in this VPC. The user is trying to create another subnet with the same VPC for CIDR 20.0.0.1/24. What will happen in this scenario? A. The VPC will modify the first subnet CIDR automatically to allow the second subnet IP range B. It is not possible to create a subnet with the same CIDR as VPC C. The second subnet will be created D. It will throw a CIDR overlaps error Answer: D Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. The user can create a subnet with the same size of VPC. However, he cannot create any other subnet since the CIDR of the second subnet will conflict with the first subnet. QUESTION: 214 A user has launched an RDS MySQL DB with the Multi AZ feature. The user has scheduled the scaling of instance storage during maintenance window. What is the correct order of events during maintenance window? Perform maintenance on standby Promote standby to primary Perform maintenance on original primary Promote original master back as primary A. 1, 2, 3, 4 B. 1, 2, 3 C. 2, 3, 1, 4 Answer: B Explanation: Running MySQL on the RDS DB instance as a Multi-AZ deployment can help the user reduce the impact of a maintenance event, as the Amazon will conduct maintenance by AWS-SysOps 112http://www.examarea.comhttp://www.fravo.com following the steps in the below mentioned order: Perform maintenance on standby Promote standby to primary Perform maintenance on original primary, which becomes the new standby. QUESTION: 215 A sys admin is using server side encryption with AWS S3. Which of the below mentioned statements helps the user understand the S3 encryption functionality? A. The server side encryption with the user supplied key works when versioning is enabled B. The user can use the AWS console, SDK and APIs to encrypt or decrypt the content for server side encryption with the user supplied key C. The user must send an AES-128 encrypted key D. The user can upload his own encryption key to the S3 console Answer: A Explanation: AWS S3 supports client side or server side encryption to encrypt all data at rest. The server side encryption can either have the S3 supplied AES-256 encryption key or the user can send the key along with each API call to supply his own encryption key. The encryption with the user supplied key (SSE-C. does not work with the AWS console. The S3 does not store the keys and the user has to send a key with each request. The SSE-C works when the user has enabled versioning. QUESTION: 216 A root account owner is trying to understand the S3 bucket ACL. Which of the below mentioned options cannot be used to grant ACL on the object using the authorized predefined group? A. Authenticated user group B. All users group C. Log Delivery Group D. Canonical user group Answer: D Explanation: An S3 bucket ACL grantee can be an AWS account or one of the predefined Amazon S3 groups. Amazon S3 has a set of predefined groups. When granting account access to AWS-SysOps 113http://www.examarea.comhttp://www.fravo.com a group, the user can specify one of the URLs of that group instead of a canonical user ID. AWS S3 has the following predefined groups: Authenticated Users group: It represents all AWS accounts. All Users group: Access permission to this group allows anyone to access the resource. Log Delivery group: WRITE permission on a bucket enables this group to write server access logs to the bucket. QUESTION: 217 A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created a public subnet CIDR (20.0.0.0/24. and VPN only subnets CIDR (20.0.1.0/24. along with the VPN gateway (vgw-12345. to connect to the user’s data centre. The user’s data centre has CIDR 172.28.0.0/12. The user has also setup a NAT instance (i-123456. to allow traffic to the internet from the VPN subnet. Which of the below mentioned options is not a valid entry for the main route table in this scenario? A. Destination: 20.0.1.0/24 and Target: i-12345 B. Destination: 0.0.0.0/0 and Target: i-12345 C. Destination: 172.28.0.0/12 and Target: vgw-12345 D. Destination: 20.0.0.0/16 and Target: local Answer: A Explanation: The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data centre, he can setup a public and VPN only subnet which uses hardware VPN access to connect with his data centre. When the user has configured this setup with Wizard, it will create a virtual private gateway to route all traffic of the VPN subnet. If the user has setup a NAT instance to route all the internet requests then all requests to the internet should be routed to it. All requests to the organization’s DC will be routed to the VPN gateway. Here are the valid entries for the main route table in this scenario: Destination: 0.0.0.0/0 & Target: i-12345 (To route all internet traffic to the NAT Instance. Destination: 172.28.0.0/12 & Target: vgw-12345 (To route all the organization’s data centre traffic to the VPN gateway. Destination: 20.0.0.0/16 & Target: local (To allow local routing in VPC. QUESTION: 218 A user has created a VPC with public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24 . The NAT instance ID is i-a12345. Which of the below mentioned entries are required in the main route table attached with the private subnet to allow instances to connect with the internet? AWS-SysOps 114http://www.examarea.comhttp://www.fravo.com A. Destination: 0.0.0.0/0 and Target: i-a12345 B. Destination: 20.0.0.0/0 and Target: 80 C. Destination: 20.0.0.0/0 and Target: i-a12345 D. Destination: 20.0.0.0/24 and Target: i-a12345 Answer: A Explanation: A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet, the instances in the public subnet can receive inbound traffic directly from the Internet, whereas the instances in the private subnet cannot. If these subnets are created with Wizard, AWS will create two route tables and attach to the subnets. The main route table will have the entry “Destination: 0.0.0.0/0 and Target: ia12345”, which allows all the instances in the private subnet to connect to the internet using NAT. QUESTION: 219 A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL. When the IAM user logs in to the S3 console, which actions can he perform? A. He can just view the content of the bucket B. He can do all the operations on the bucket C. It is not possible to give access to an IAM user using ACL D. The IAM user can perform all operations on the bucket using only API/SDK Answer: C Explanation: Each AWS S3 bucket and object has an ACL (Access Control List. associated with it. An ACL is a list of grants identifying the grantee and the permission granted. The user can use ACLs to grant basic read/write permissions to other AWS accounts. ACLs use an Amazon S3–specific XML schema. The user cannot grant permissions to other users (IAM users. in his account. QUESTION: 220 An organization has configured Auto Scaling with ELB. There is a memory issue in the application which is causing CPU utilization to go above 90%. The higher CPU usage triggers an event for Auto Scaling as per the scaling policy. If the user wants to find the AWS-SysOps 115http://www.examarea.comhttp://www.fravo.com root cause inside the application without triggering a scaling activity, how can he achieve this? A. Stop the scaling process until research is completed B. It is not possible to find the root cause from that instance without triggering scaling C. Delete Auto Scaling until research is completed D. Suspend the scaling process until research is completed Answer: D Explanation: Auto Scaling allows the user to suspend and then resume one or more of the Auto Scaling processes in the Auto Scaling group. This is very useful when the user wants to investigate a configuration problem or some other issue, such as a memory leak with the web application and then make changes to the application, without triggering the Auto Scaling process. QUESTION: 221 A sys admin is planning to subscribe to the RDS event notifications. For which of the below mentioned source categories the subscription cannot be configured? A. DB security group B. DB snapshot C. DB options group D. DB parameter group Answer: C Explanation: Amazon RDS uses the Amazon Simple Notification Service (SNS. to provide a notification when an Amazon RDS event occurs. These events can be configured for source categories, such as DB instance, DB security group, DB snapshot and DB parameter group. QUESTION: 222 A user has launched an EC2 instance. The instance got terminated as soon as it was launched. Which of the below mentioned options is not a possible reason for this? A. The user account has reached the maximum EC2 instance limit AWS-SysOps 116http://www.examarea.comhttp://www.fravo.com B. The snapshot is corrupt C. The AMI is missing. It is the required part D. The user account has reached the maximum volume limit Answer: A Explanation: When the user account has reached the maximum number of EC2 instances, it will not be allowed to launch an instance. AWS will throw an ‘InstanceLimitExceeded’ error. For all other reasons, such as “AMI is missing part”, “Corrupt Snapshot” or ”Volume limit has reached” it will launch an EC2 instance and then terminate it. QUESTION: 223 A user is trying to understand the detailed CloudWatch monitoring concept. Which of the below mentioned services does not provide detailed monitoring with CloudWatch? A. AWS EMR B. AWS RDS C. AWS ELB D. AWS Route53 Answer: A Explanation: CloudWatch is used to monitor AWS as well as the custom services. It provides either basic or detailed monitoring for the supported AWS products. In basic monitoring, a service sends data points to CloudWatch every five minutes, while in detailed monitoring a service sends data points to CloudWatch every minute. Services, such as RDS, EC2, Auto Scaling, ELB, and Route 53 can provide the monitoring data every minute. QUESTION: 224 A user is measuring the CPU utilization of a private data centre machine every minute. The machine provides the aggregate of data every hour, such as Sum of data”, “Min value”, “Max value, and “Number of Data points”. The user wants to send these values to CloudWatch. How can the user achieve this? A. Send the data using the put-metric-data command with the aggregate-values parameter B. Send the data using the put-metric-data command with the average-values parameter AWS-SysOps 117http://www.examarea.comhttp://www.fravo.com C. Send the data using the put-metric-data command with the statistic-values parameter D. Send the data using the put-metric-data command with the aggregate –data parameter Answer: C Explanation: AWS CloudWatch supports the custom metrics. The user can always capture the custom data and upload the data to CloudWatch using CLI or APIs. The user can publish the data to CloudWatch as single data points or as an aggregated set of data points called a statistic set using the command put-metric-data. When sending the aggregate data, the user needs to send it with the parameter statistic-values: awscloudwatch put-metric-data --metric-name <Name> --namespace <Custom namespace> -- timestamp <UTC Format> --statistic-values Sum=XX,Minimum=YY,Maximum=AA,SampleCount=BB --unit Milliseconds QUESTION: 225 A user has enabled detailed CloudWatch monitoring with the AWS Simple Notification Service. Which of the below mentioned statements helps the user understand detailed monitoring better? A. SNS will send data every minute after configuration B. There is no need to enable since SNS provides data every minute C. AWS CloudWatch does not support monitoring for SNS D. SNS cannot provide data every minute Answer: D Explanation: CloudWatch is used to monitor AWS as well as the custom services. It provides either basic or detailed monitoring for the supported AWS products. In basic monitoring, a service sends data points to CloudWatch every five minutes, while in detailed monitoring a service sends data points to CloudWatch every minute. The AWS SNS service sends data every 5 minutes. Thus, it supports only the basic monitoring. The user cannot enable detailed monitoring with SNS. QUESTION: 226 A user has setup a VPC with CIDR 20.0.0.0/16. The VPC has a private subnet (20.0.1.0/24. and a public subnet (20.0.0.0/24.. The user’s data centre has CIDR of 20.0.54.0/24 and 20.1.0.0/24. If the private subnet wants to communicate with the data AWS-SysOps 118http://www.examarea.comhttp://www.fravo.com centre, what will happen? A. It will allow traffic communication on both the CIDRs of the data centre B. It will not allow traffic with data centre on CIDR 20.1.0.0/24 but allows traffic communication on 20.0.54.0/24 C. It will not allow traffic communication on any of the data centre CIDRs D. It will allow traffic with data centre on CIDR 20.1.0.0/24 but does not allow on 20.0.54.0/24 Answer: D Explanation: VPC allows the user to set up a connection between his VPC and corporate or home network data centre. If the user has an IP address prefix in the VPC that overlaps with one of the networks' prefixes, any traffic to the network's prefix is dropped. In this case CIDR 20.0.54.0/24 falls in the VPC’s CIDR range of 20.0.0.0/16. Thus, it will not allow traffic on that IP. In the case of 20.1.0.0/24, it does not fall in the VPC’s CIDR range. Thus, traffic will be allowed on it. QUESTION: 227 A user wants to find the particular error that occurred on a certain date in the AWS MySQL RDS DB. Which of the below mentioned activities may help the user to get the data easily? A. It is not possible to get the log files for MySQL RDS B. Find all the transaction logs and query on those records C. Direct the logs to the DB table and then query that table D. Download the log file to DynamoDB and search for the record Answer: C Explanation: The user can view, download, and watch the database logs using the Amazon RDS console, the Command Line Interface (CLI. or the Amazon RDS API. For the MySQL RDS, the user can view the error log, slow query log, and general logs. The user can also view the MySQL logs easily by directing the logs to a database table in the main database and querying that table. QUESTION: 228 A user is trying to send custom metrics to CloudWatch using the PutMetricData APIs. AWS-SysOps 119http://www.examarea.comhttp://www.fravo.com Which of the below mentioned points should the user needs to take care while sending the data to CloudWatch? A. The size of a request is limited to 8KB for HTTP GET requests and 40KB for HTTP POST requests B. The size of a request is limited to 128KB for HTTP GET requests and 64KB for HTTP POST requests C. The size of a request is limited to 40KB for HTTP GET requests and 8KB for HTTP POST requests D. The size of a request is limited to 16KB for HTTP GET requests and 80KB for HTTP POST requests Answer: A Explanation: With AWS CloudWatch, the user can publish data points for a metric that share not only the same time stamp, but also the same namespace and dimensions. CloudWatch can accept multiple data points in the same PutMetricData call with the same time stamp. The only thing that the user needs to take care of is that the size of a PutMetricData request is limited to 8KB for HTTP GET requests and 40KB for HTTP POST requests. QUESTION: 229 An AWS account owner has setup multiple IAM users. One IAM user only has CloudWatch access. He has setup the alarm action which stops the EC2 instances when the CPU utilization is below the threshold limit. What will happen in this case? A. It is not possible to stop the instance using the CloudWatch alarm B. CloudWatch will stop the instance when the action is executed C. The user cannot set an alarm on EC2 since he does not have the permission D. The user can setup the action but it will not be executed if the user does not have EC2 rights Answer: D Explanation: Amazon CloudWatch alarms watch a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The user can setup an action which stops the instances when their CPU utilization is below a certain threshold for a certain period of time. The EC2 action can either terminate or stop the instance as part of the AWS-SysOps 120http://www.examarea.comhttp://www.fravo.com EC2 action. If the IAM user has read/write permissions for Amazon CloudWatch but not for Amazon EC2, he can still create an alarm. However, the stop or terminate actions will not be performed on the Amazon EC2 instance. QUESTION: 230 A user has configured ELB with Auto Scaling. The user suspended the Auto Scaling terminate process only for a while. What will happen to the availability zone rebalancing process (AZRebalance. during this period? A. Auto Scaling will not launch or terminate any instances B. Auto Scaling will allow the instances to grow more than the maximum size C. Auto Scaling will keep launching instances till the maximum instance size D. It is not possible to suspend the terminate process while keeping the launch active Answer: B Explanation: Auto Scaling performs various processes, such as Launch, Terminate, Availability Zone Rebalance (AZRebalance. etc. The AZRebalance process type seeks to maintain a balanced number of instances across Availability Zones within a region. If the user suspends the Terminate process, the AZRebalance process can cause the Auto Scaling group to grow up to ten percent larger than the maximum size. This is because Auto Scaling allows groups to temporarily grow larger than the maximum size during rebalancing activities. If Auto Scaling cannot terminate instances, the Auto Scaling group could remain up to ten percent larger than the maximum size until the user resumes the Terminate process type. QUESTION: 231 A user has created a mobile application which makes calls to DynamoDB to fetch certain data. The application is using the DynamoDB SDK and root account access/secret access key to connect to DynamoDB from mobile. Which of the below mentioned statements is true with respect to the best practice for security in this scenario? A. The user should create a separate IAM user for each mobile application and provide DynamoDB access with it B. The user should create an IAM role with DynamoDB and EC2 access. Attach the role with EC2 and route all calls from the mobile through EC2 C. The application should use an IAM role with web identity federation which validates calls to DynamoDB with identity providers, such as Google, Amazon, and Facebook D. Create an IAM Role with DynamoDB access and attach it with the mobile AWS-SysOps 121http://www.examarea.comhttp://www.fravo.com application Answer: C Explanation: With AWS IAM a user is creating an application which runs on an EC2 instance and makes requests to AWS, such as DynamoDB or S3 calls. Here it is recommended that the user should not create an IAM user and pass the user's credentials to the application or embed those credentials inside the application. If the user is creating an app that runs on a mobile phone and makes requests to AWS, the user should not create an IAMuser and distribute the user's access key with the app. Instead, he should use an identity provider, such as Login with Amazon, Facebook, or Google to authenticate the users, and then use that identity to get temporary security credentials. QUESTION: 232 A user is configuring the Multi AZ feature of an RDS DB. The user came to know that this RDS DB does not use the AWS technology, but uses server mirroring to achieve HA. Which DB is the user using right now? A. My SQL B. Oracle C. MS SQL D. PostgreSQL Answer: C Explanation: Amazon RDS provides high availability and failover support for DB instances using Multi AZ deployments. In a Multi AZ deployment, Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. Multi AZ deployments for Oracle, PostgreSQL, and MySQL DB instances use Amazon technology, while SQL Server (MS SQL. DB instances use SQL Server Mirroring. QUESTION: 233 A user is receiving a notification from the RDS DB whenever there is a change in the DB security group. The user does not want to receive these notifications for only a month. Thus, he does not want to delete the notification. How can the user configure this? AWS-SysOps 122http://www.examarea.comhttp://www.fravo.com A. Change the Disable button for notification to “Yes” in the RDS console B. Set the send mail flag to false in the DB event notification console C. The only option is to delete the notification from the console D. Change the Enable button for notification to “No” in the RDS console Answer: D Explanation: Amazon RDS uses the Amazon Simple Notification Service to provide a notification when an Amazon RDS event occurs. Event notifications are sent to the addresses that the user has provided while creating the subscription. The user can easily turn off the notification without deleting a subscription by setting the Enabled radio button to No in the Amazon RDS console or by setting the Enabled parameter to false using the CLI or Amazon RDS API. QUESTION: 234 A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 by mistake. The user is trying to create another subnet of CIDR 20.0.0.1/24. How can the user create the second subnet? A. There is no need to update the subnet as VPC automatically adjusts the CIDR of the first subnet based on the second subnet’s CIDR B. The user can modify the first subnet CIDR from the console C. It is not possible to create a second subnet as one subnet with the same CIDR as the VPC has been created D. The user can modify the first subnet CIDR with AWS CLI Answer: D Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside the subnet. The user can create a subnet with the same size of VPC. However, he cannot create any other subnet since the CIDR of the second subnet will conflict with the first subnet. The user cannot modify the CIDR of a subnet once it is created. Thus, in this case if required, the user has to delete the subnet and create new subnets. QUESTION: 235 A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is AWS-SysOps 123http://www.examarea.comhttp://www.fravo.com planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306.. The user is configuring a security group for the public subnet (WebSecGrp. and the private subnet (DBSecGrp.. Which of the below mentioned entries is required in the web server security group (WebSecGrp.? A. Configure Destination as DB Security group ID (DbSecGrp. for port 3306 Outbound B. 80 for Destination 0.0.0.0/0 Outbound C. Configure port 3306 for source 20.0.0.0/24 InBound D. Configure port 80 InBound for source 20.0.0.0/16 Answer: A Explanation: A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet to host the web server and DB server respectively, the user should configure that the instances in the public subnet can receive inbound traffic directly from the internet. Thus, the user should configure port 80 with source 0.0.0.0/0 in InBound. The user should configure that the instance in the public subnet can send traffic to the private subnet instances on the DB port. Thus, the user should configure the DB security group of the private subnet (DbSecGrp. as the destination for port 3306 in Outbound. QUESTION: 236 A user is trying to understand the detailed CloudWatch monitoring concept. Which of the below mentioned services provides detailed monitoring with CloudWatch without charging the user extra? A. AWS Auto Scaling B. AWS Route 53 C. AWS EMR D. AWS SNS Answer: B Explanation: Cloud Watch is used to monitor AWS as well as the custom services. It provides either basic or detailed monitoring for the supported AWS products. In basic monitoring, a service sends data points to CloudWatch every five minutes, while in detailed monitoring a service sends data points to CloudWatch every minute. Services, such as RDS, ELB, OpsWorks, and Route 53 can provide the monitoring data every minute without charging the user. AWS-SysOps 124http://www.examarea.comhttp://www.fravo.com QUESTION: 237 A user is trying to understand the CloudWatch metrics for the AWS services. It is required that the user should first understand the namespace for the AWS services. Which of the below mentioned is not a valid namespace for the AWS services? A. AWS/StorageGateway B. AWS/CloudTrail C. AWS/ElastiCache D. AWS/SWF Answer: B Explanation: Amazon CloudWatch is basically a metrics repository. The AWS product puts metrics into this repository, and the user can retrieve the data or statistics based on those metrics. To distinguish the data for each service, the CloudWatch metric has a namespace. Namespaces are containers for metrics. All AWS services that provide the Amazon CloudWatch data use a namespace string, beginning with "AWS/". All the services which are supported by CloudWatch will have some namespace. CloudWatch does not monitor CloudTrail. Thus, the namespace “AWS/CloudTrail” is incorrect. QUESTION: 238 A system admin is planning to encrypt all objects being uploaded to S3 from an application. The system admin does not want to implement his own encryption algorithm; instead he is planning to use server side encryption by supplying his own key (SSE-C.. Which parameter is not required while making a call for SSE-C? A. x-amz-server-side-encryption-customer-key-AES-256 B. x-amz-server-side-encryption-customer-key C. x-amz-server-side-encryption-customer-algorithm D. x-amz-server-side-encryption-customer-key-MD5 Answer: A Explanation: AWS S3 supports client side or server side encryption to encrypt all data at rest. The server side encryption can either have the S3 supplied AES-256 encryption key or the user can send the key along with each API call to supply his own encryption key (SSEC.. When the user is supplying his own encryption key, the user has to send the below AWS-SysOps 125http://www.examarea.comhttp://www.fravo.com mentioned parameters as a part of the API calls: x-amz-server-side-encryption-customer-algorithm: Specifies the encryption algorithm x-amz-server-side-encryption-customer-key: To provide the base64-encoded encryption key x-amz-server-side-encryption-customer-key-MD5: To provide the base64-encoded 128-bit MD5 digest of the encryption key QUESTION: 239 A user is using the AWS SQS to decouple the services. Which of the below mentioned operations is not supported by SQS? A. SendMessageBatch B. DeleteMessageBatch C. CreateQueue D. DeleteMessageQueue Answer: D Explanation: Amazon Simple Queue Service (SQS. is a fast, reliable, scalable, and fully managed message queuing service. SQS provides a simple and cost-effective way to decouple the components of an application. The user can perform the following set of operations using the Amazon SQS: CreateQueue, ListQueues, DeleteQueue, SendMessage, SendMessageBatch, ReceiveMessage, DeleteMessage, DeleteMessageBatch, ChangeMessageVisibility, ChangeMessageVisibilityBatch, SetQueueAttributes, GetQueueAttributes, GetQueueUrl, AddPermission and RemovePermission. Operations can be performed only by the AWS account owner or an AWS account that the account owner has delegated to. QUESTION: 240 A user has configured Auto Scaling with 3 instances. The user had created a new AMI after updating one of the instances. If the user wants to terminate two specific instances to ensure that Auto Scaling launches an instances with the new launch configuration, which command should he run? A. as-delete-instance-in-auto-scaling-group <Instance ID> --no-decrement-desiredcapacity B. as-terminate-instance-in-auto-scaling-group <Instance ID> --update-desired-capacity C. as-terminate-instance-in-auto-scaling-group <Instance ID> --decrement-desiredcapacity D. as-terminate-instance-in-auto-scaling-group <Instance ID> --no-decrement-desiredcapacity AWS-SysOps 126http://www.examarea.comhttp://www.fravo.com Answer: D Explanation: The Auto Scaling command as-terminate-instance-in-auto-scaling-group <Instance ID> will terminate the specific instance ID. The user is required to specify the parameter as –no-decrement-desired- capacity to ensure that it launches a new instance from the launch config after terminating the instance. If the user specifies the parameter -- decrement-desired-capacity then Auto Scaling will terminate the instance and decrease the desired capacity by 1. QUESTION: 241 A user has launched an EC2 instance from an instance store backed AMI. If the user restarts the instance, what will happen to the ephermal storage data? A. All the data will be erased but the ephermal storage will stay connected B. All data will be erased and the ephermal storage is released C. It is not possible to restart an instance launched from an instance store backed AMI D. The data is preserved Answer: D Explanation: A user can reboot an EC2 instance using the AWS console, the Amazon EC2 CLI or the Amazon EC2 API. Rebooting an instance is equivalent to rebooting an operating system. However, it is recommended that the user use Amazon EC2 to reboot the instance instead of running the operating system reboot command from the instance. When an instance launched from an instance store backed AMI is rebooted all the ephermal storage data is still preserved. QUESTION: 242 A user has launched an EC2 instance. However, due to some reason the instance was terminated. If the user wants to find out the reason for termination, where can he find the details? A. It is not possible to find the details after the instance is terminated B. The user can get information from the AWS console, by checking the Instance description under the State transition reason label C. The user can get information from the AWS console, by checking the Instance AWS-SysOps 127http://www.examarea.comhttp://www.fravo.com description under the Instance Status Change reason label D. The user can get information from the AWS console, by checking the Instance description under the Instance Termination reason label Answer: D Explanation: An EC2 instance, once terminated, may be available in the AWS console for a while after termination. The user can find the details about the termination from the description tab under the label State transition reason. If the instance is still running, there will be no reason listed. If the user has explicitly stopped or terminated the instance, the reason will be “User initiated shutdown”. QUESTION: 243 A user has created a VPC with CIDR 20.0.0.0/24. The user has used all the IPs of CIDR and wants to increase the size of the VPC. The user has two subnets: public (20.0.0.0/28. and private (20.0.1.0/28.. How can the user change the size of the VPC? A. The user can delete all the instances of the subnet. Change the size of the subnets to 20.0.0.0/32 and 20.0.1.0/32, respectively. Then the user can increase the size of the VPC using CLI B. It is not possible to change the size of the VPC once it has been created C. The user can add a subnet with a higher range so that it will automatically increase the size of the VPC D. The user can delete the subnets first and then modify the size of the VPC Answer: B Explanation: Once the user has created a VPC, he cannot change the CIDR of that VPC. The user has to terminate all the instances, delete the subnets and then delete the VPC. Create a new VPC with a higher size and launch instances with the newly created VPC and subnets. QUESTION: 244 A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned security policies is supported by ELB? A. Dynamic Security Policy B. All the other options AWS-SysOps 128http://www.examarea.comhttp://www.fravo.com C. Predefined Security Policy D. Default Security Policy Answer: C Explanation: Elastic Load Balancing uses a Secure Socket Layer (SSL. negotiation configuration which is known as a Security Policy. It is used to negotiate the SSL connections between a client and the load balancer. ELB supports two policies: Predefined Security Policy, which comes with predefined cipher and SSL protocols; Custom Security Policy, which allows the user to configure a policy. QUESTION: 245 A user has granted read/write permission of his S3 bucket using ACL. Which of the below mentioned options is a valid ID to grant permission to other AWS accounts (grantee. using ACL? A. IAM User ID B. S3 Secure ID C. Access ID D. Canonical user ID Answer: D Explanation: An S3 bucket ACL grantee can be an AWS account or one of the predefined Amazon S3 groups. The user can grant permission to an AWS account by the email address of that account or by the canonical user ID. If the user provides an email in the grant request, Amazon S3 finds the canonical user ID for that account and adds it to the ACL. The resulting ACL will always contain the canonical user ID for the AWS account, and not the AWS account's email address. QUESTION: 246 A user has configured an ELB to distribute the traffic among multiple instances. The user instances are facing some issues due to the back-end servers. Which of the below mentioned CloudWatch metrics helps the user understand the issue with the instances? A. HTTPCode_Backend_3XX B. HTTPCode_Backend_4XX C. HTTPCode_Backend_2XX AWS-SysOps 129http://www.examarea.comhttp://www.fravo.com D. HTTPCode_Backend_5XX Answer: D Explanation: CloudWatch is used to monitor AWS as well as the custom services. For ELB, CloudWatch provides various metrics including error code by ELB as well as by backend servers (instances.. It gives data for the count of the number of HTTP response codes generated by the back-end instances. This metric does not include any response codes generated by the load balancer. These metrics are: The 2XX class status codes represents successful actions The 3XX class status code indicates that the user agent requires action The 4XX class status code represents client errors The 5XX class status code represents back-end server errors QUESTION: 247 A user has launched an EC2 instance store backed instance in the US-East-1a zone. The user created AMI #1 and copied it to the Europe region. After that, the user made a few updates to the application running in the US-East-1a zone. The user makes an AMI#2 after the changes. If the user launches a new instance in Europe from the AMI #1 copy, which of the below mentioned statements is true? A. The new instance will have the changes made after the AMI copy as AWS just copies the reference of the original AMI during the copying. Thus, the copied AMI will have all the updated data B. The new instance will have the changes made after the AMI copy since AWS keeps updating the AMI C. It is not possible to copy the instance store backed AMI from one region to another D. The new instance in the EU region will not have the changes made after the AMI copy Answer: D Explanation: Within EC2, when the user copies an AMI, the new AMI is fully independent of the source AMI; there is no link to the original (source. AMI. The user can modify the source AMI without affecting the new AMI and vice a versa. Therefore, in this case even if the source AMI is modified, the copied AMI of the EU region will not have the changes. Thus, after copy the user needs to copy the new source AMI to the destination region to get those changes. AWS-SysOps 130http://www.examarea.comhttp://www.fravo.com QUESTION: 248 A user runs the command “dd if=/dev/zero of=/dev/xvdfbs=1M” on a fresh blank EBS volume attached to a Linux instance. Which of the below mentioned activities is the user performing with the command given above? A. Creating a file system on the EBS volume B. Mounting the device to the instance C. Pre warming the EBS volume D. Formatting the EBS volume Answer: C Explanation: When the user creates a new EBS volume and is trying to access it for the first time it will encounter reduced IOPS due to wiping or initiating of the block storage. To avoid this as well as achieve the best performance it is required to pre warm the EBS volume. For a blank volume attached with a Linux OS, the “dd” command is used to write to all the blocks on the device. In the command “dd if=/dev/zero of=/dev/xvdfbs=1M” the parameter “if =import file” should be set to one of the Linux virtual devices, such as /dev/zero. The “of=output file” parameter should be set to the drive that the user wishes to warm. The “bs” parameter sets the block size of the write operation; for optimal performance, this should be set to 1 MB. QUESTION: 249 A user has created an Auto Scaling group using CLI. The user wants to enable CloudWatch detailed monitoring for that group. How can the user configure this? A. When the user sets an alarm on the Auto Scaling group, it automatically enables detail monitoring B. By default detailed monitoring is enabled for Auto Scaling C. Auto Scaling does not support detailed monitoring D. Enable detail monitoring from the AWS console Answer: B Explanation: CloudWatch is used to monitor AWS as well as the custom services. It provides either basic or detailed monitoring for the supported AWS products. In basic monitoring, a service sends data points to CloudWatch every five minutes, while in detailed AWS-SysOps 131http://www.examarea.comhttp://www.fravo.com monitoring a service sends data points to CloudWatch every minute. To enable detailed instance monitoring for a new Auto Scaling group, the user does not need to take any extra steps. When the user creates an Auto Scaling launch config as the first step for creating an Auto Scaling group, each launch configuration contains a flag named InstanceMonitoring.Enabled. The default value of this flag is true. Thus, the user does not need to set this flag if he wants detailed monitoring. QUESTION: 250 A user has created a VPC with a public subnet. The user has terminated all the instances which are part of the subnet. Which of the below mentioned statements is true with respect to this scenario? A. The user cannot delete the VPC since the subnet is not deleted B. All network interface attached with the instances will be deleted C. When the user launches a new instance it cannot use the same subnet D. The subnet to which the instances were launched with will be deleted Answer: B Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. When an instance is launched it will have a network interface attached with it. The user cannot delete the subnet until he terminates the instance and deletes the network interface. When the user terminates the instance all the network interfaces attached with it are also deleted. QUESTION: 251 A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. The ELB security policy supports various ciphers. Which of the below mentioned options helps identify the matching cipher at the client side to the ELB cipher list when client is requesting ELB DNS over SSL? A. Cipher Protocol B. Client Configuration Preference C. Server Order Preference D. Load Balancer Preference Answer: C AWS-SysOps 132http://www.examarea.comhttp://www.fravo.com Explanation: Elastic Load Balancing uses a Secure Socket Layer (SSL. negotiation configuration which is known as a Security Policy. It is used to negotiate the SSL connections between a client and the load balancer. When client is requesting ELB DNS over SSL and if the load balancer is configured to support the Server Order Preference, then the load balancer gets to select the first cipher in its list that matches any one of the ciphers in the client's list. Server Order Preference ensures that the load balancer determines which cipher is used for the SSL connection. QUESTION: 252 A user has created a VPC with public and private subnets. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.1.0/24 and the public subnet uses CIDR 20.0.0.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306.. The user is configuring a security group of the NAT instance. Which of the below mentioned entries is not required for the NAT security group? A. For Inbound allow Source: 20.0.1.0/24 on port 80 B. For Outbound allow Destination: 0.0.0.0/0 on port 80 C. For Inbound allow Source: 20.0.0.0/24 on port 80 D. For Outbound allow Destination: 0.0.0.0/0 on port 443 Answer: C Explanation: A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet to host the web server and DB server respectively, the user should configure that the instances in the private subnet can connect to the internet using the NAT instances. The user should first configure that NAT can receive traffic on ports 80 and 443 from the private subnet. Thus, allow ports 80 and 443 in Inbound for the private subnet 20.0.1.0/24.Now to route this traffic to the internet configure ports 80 and 443 in Outbound with destination 0.0.0.0/0. The NAT should not have an entry for the public subnet CIDR. QUESTION: 253 A user has created an application which will be hosted on EC2. The application makes calls to DynamoDB to fetch certain data. The application is using the DynamoDB SDK to connect with from the EC2 instance. Which of the below mentioned statements is true with respect to the best practice for security in this scenario? A. The user should attach an IAM role with DynamoDB access to the EC2 instance AWS-SysOps 133http://www.examarea.comhttp://www.fravo.com B. The user should create an IAM user with DynamoDB access and use its credentials within the application to connect with DynamoDB C. The user should create an IAM role, which has EC2 access so that it will allow deploying the application D. The user should create an IAM user with DynamoDB and EC2 access. Attach the user with the application so that it does not use the root account credentials Answer: A Explanation: With AWS IAM a user is creating an application which runs on an EC2 instance and makes requests to AWS, such as DynamoDB or S3 calls. Here it is recommended that the user should not create an IAM user and pass the user's credentials to the application or embed those credentials inside the application. Instead, the user should use roles for EC2 and give that role access to DynamoDB /S3. When the roles are attached to EC2, it will give temporary security credentials to the application hosted on that EC2, to connect with DynamoDB / S3. QUESTION: 254 An organization (Account ID 123412341234. has attached the below mentioned IAM policy to a user. What does this policy statement entitle the user to perform? { "Version": "2012-10-17", "Statement": [{ "Sid": "AllowUsersAllActionsForCredentials", "Effect": "Allow", "Action": [ "iam:*LoginProfile", "iam:*AccessKey*", "iam:*SigningCertificate*" ], "Resource": ["arn:aws:iam:: 123412341234:user/${aws:username}"] }] } A. The policy allows the IAM user to modify all IAM user’s credentials using the console, SDK, CLI or APIs B. The policy will give an invalid resource error C. The policy allows the IAM user to modify all credentials using only the console D. The policy allows the user to modify all IAM user’s password, sign in certificates and access keys using only CLI, SDK or APIs Answer: D Explanation: WS Identity and Access Management is a web service which allows organizations to AWS-SysOps 134http://www.examarea.comhttp://www.fravo.com manage users and user permissions for various AWS services. If the organization (Account ID 123412341234. wants some of their users to manage credentials (access keys, password, and sing in certificates. of all IAM users, they should set an applicable policy to that user or group of users. The below mentioned policy allows the IAM user to modify the credentials of all IAM user’s using only CLI, SDK or APIs. The user cannot use the AWS console for this activity since he does not have list permission for the IAM users. { "Version": "2012-10-17", "Statement": [{ "Sid": "AllowUsersAllActionsForCredentials", "Effect": "Allow" "Action": [ "iam:*LoginProfile", "iam:*AccessKey*", "iam:*SigningCertificate*" ], "Resource": ["arn:aws:iam::123412341234:user/${aws:username}"] }] } QUESTION: 255 A sys admin is trying to understand the sticky session algorithm. Please select the correct sequence of steps, both when the cookie is present and when it is not, to help the admin understand the implementation of the sticky session: ELB inserts the cookie in the response ELB chooses the instance based on the load balancing algorithm Check the cookie in the service request The cookie is found in the request The cookie is not found in the request A. 3,1,4,2 [Cookie is not Present] & 3,1,5,2 [Cookie is Present] B. 3,4,1,2 [Cookie is not Present] & 3,5,1,2 [Cookie is Present] C. 3,5,2,1 [Cookie is not Present] & 3,4,2,1 [Cookie is Present] D. 3,2,5,4 [Cookie is not Present] & 3,2,4,5 [Cookie is Present] Answer: C Explanation: Generally AWS ELB routes each request to a zone with the minimum load. The Elastic Load Balancer provides a feature called sticky session which binds the user’s session with a specific EC2 instance. The load balancer uses a special load-balancer-generated cookie to track the application instance for each request. When the load balancer receives a request, it first checks to see if this cookie is present in the request. If so, the request is sent to the application instance specified in the cookie. If there is no cookie, the load balancer chooses an application instance based on the existing load balancing algorithm. A cookie is inserted into the response for binding subsequent requests from AWS-SysOps 135http://www.examarea.comhttp://www.fravo.com the same user to that application instance. QUESTION: 256 A user has a weighing plant. The user measures the weight of some goods every 5 minutes and sends data to AWS CloudWatch for monitoring and tracking. Which of the below mentioned parameters is mandatory for the user to include in the request list? A. Value B. Namespace C. Metric Name D. Timezone Answer: B Explanation: AWS CloudWatch supports the custom metrics. The user can always capture the custom data and upload the data to CloudWatch using CLI or APIs. The user can publish the data to CloudWatch as single data points or as an aggregated set of data points called a statistic set. The user has to always include the namespace as part of the request. The user can supply a file instead of the metric name. If the user does not supply the timezone, it accepts the current time. If the user is sending the data as a single data point it will have parameters, such as value. However, if the user is sending as an aggregate it will have parameters, such as statistic-values. QUESTION: 257 An organization has configured Auto Scaling for hosting their application. The system admin wants to understand the Auto Scaling health check process. If the instance is unhealthy, Auto Scaling launches an instance and terminates the unhealthy instance. What is the order execution? A. Auto Scaling launches a new instance first and then terminates the unhealthy instance B. Auto Scaling performs the launch and terminate processes in a random order C. Auto Scaling launches and terminates the instances simultaneously D. Auto Scaling terminates the instance first and then launches a new instance Answer: D Explanation: Auto Scaling keeps checking the health of the instances at regular intervals and marks AWS-SysOps 136http://www.examarea.comhttp://www.fravo.com the instance for replacement when it is unhealthy. The ReplaceUnhealthy process terminates instances which are marked as unhealthy and subsequently creates new instances to replace them. This process first terminates the instance and then launches a new instance. QUESTION: 258 A user is trying to connect to a running EC2 instance using SSH. However, the user gets an Unprotected Private Key File error. Which of the below mentioned options can be a possible reason for rejection? A. The private key file has the wrong file permission B. The ppk file used for SSH is read only C. The public key file has the wrong permission D. The user has provided the wrong user name for the OS login Answer: A Explanation: While doing SSH to an EC2 instance, if you get an Unprotected Private Key File error it means that the private key file's permissions on your computer are too open. Ideally the private key should have the Unix permission of 0400. To fix that, run the command: chmod 0400 /path/to/private.key QUESTION: 259 A user has provisioned 2000 IOPS to the EBS volume. The application hosted on that EBS is experiencing less IOPS than provisioned. Which of the below mentioned options does not affect the IOPS of the volume? A. The application does not have enough IO for the volume B. The instance is EBS optimized C. The EC2 instance has 10 Gigabit Network connectivity D. The volume size is too large Answer: D Explanation: When the application does not experience the expected IOPS or throughput of the PIOPS EBS volume that was provisioned, the possible root cause could be that the EC2 bandwidth is the limiting factor and the instance might not be either EBS-optimized or might not have 10 Gigabit network connectivity. Another possible cause for not AWS-SysOps 137http://www.examarea.comhttp://www.fravo.com experiencing the expected IOPS could also be that the user is not driving enough I/O to the EBS volumes. The size of the volume may not affect IOPS. QUESTION: 260 A storage admin wants to encrypt all the objects stored in S3 using server side encryption. The user does not want to use the AES 256 encryption key provided by S3. How can the user achieve this? A. The admin should upload his secret key to the AWS console and let S3 decrypt the objects B. The admin should use CLI or API to upload the encryption key to the S3 bucket. When making a call to the S3 API mention the encryption key URL in each request C. S3 does not support client supplied encryption keys for server side encryption D. The admin should send the keys and encryption algorithm with each API call Answer: D Explanation: AWS S3 supports client side or server side encryption to encrypt all data at rest. The server side encryption can either have the S3 supplied AES-256 encryption key or the user can send the key along with each API callto supply his own encryption key. Amazon S3 never stores the user’s encryption key. The user has to supply it for each encryption or decryption call. QUESTION: 261 A user is trying to create a PIOPS EBS volume with 8 GB size and 200 IOPS. Will AWS create the volume? A. Yes, since the ratio between EBS and IOPS is less than 30 B. No, since the PIOPS and EBS size ratio is less than 30 C. No, the EBS size is less than 10 GB D. Yes, since PIOPS is higher than 100 Answer: C Explanation: A provisioned IOPS EBS volume can range in size from 10 GB to 1 TB and the user can provision up to 4000 IOPS per volume. The ratio of IOPS provisioned to the volume size requested should be a maximum of 30; for example, a volume with 3000 IOPS must be at least 100 GB. AWS-SysOps 138http://www.examarea.comhttp://www.fravo.com QUESTION: 262 A user has scheduled the maintenance window of an RDS DB on Monday at 3 AM. Which of the below mentioned events may force to take the DB instance offline during the maintenance window? A. Enabling Read Replica B. Making the DB Multi AZ C. DB password change D. Security patching Answer: D Explanation: Amazon RDS performs maintenance on the DB instance during a user-definable maintenance window. The system may be offline or experience lower performance during that window. The only maintenance events that may require RDS to make the DB instance offline are: Scaling compute operations Software patching. Required software patching is automatically scheduled only for patches that are security and durability related. Such patching occurs infrequently (typically once every few months. and seldom requires more than a fraction of the maintenance window. QUESTION: 263 An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one particular group of IAM users should only access the test instances and not the production ones. How can the organization set that as a part of the policy? A. Launch the test and production instances in separate regions and allow region wise access to the group B. Define the IAM policy which allows access based on the instance ID C. Create an IAM policy with a condition which allows access to only small instances D. Define the tags on the test and production servers and add a condition to the IAM policy which allows access to specific tags Answer: D AWS-SysOps 139http://www.examarea.comhttp://www.fravo.com Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. The user can add conditions as a part of the IAM policies. The condition can be set on AWS Tags, Time, and Client IP as well as on various parameters. If the organization wants the user to access only specific instances he should define proper tags and add to the IAM policy condition. The sample policy is shown below. "Statement": [ { "Action": "ec2:*", "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/InstanceType": "Production" } } } ] QUESTION: 264 A user has configured Auto Scaling with the minimum capacity as 2 and the desired capacity as 2. The user is trying to terminate one of the existing instance with the command: as-terminate-instance-in-auto-scaling-group<Instance ID> --decrementdesired- capacity What will Auto Scaling do in this scenario? A. Terminates the instance and does not launch a new instance B. Terminates the instance and updates the desired capacity to 1 C. Terminates the instance and updates the desired capacity and minimum size to 1 D. Throws an error Answer: D Explanation: The Auto Scaling command as-terminate-instance-in-auto-scaling-group <Instance ID> will terminate the specific instance ID. The user is required to specify the parameter as --decrement-desired- capacity. Then Auto Scaling will terminate the instance and decrease the desired capacity by 1. In this case since the minimum size is 2, Auto Scaling will not allow the desired capacity to go below 2. Thus, it will throw an error. QUESTION: 265 A user is collecting 1000 records per second. The user wants to send the data to AWS-SysOps 140http://www.examarea.comhttp://www.fravo.com CloudWatch using the custom namespace. Which of the below mentioned options is recommended for this activity? A. Aggregate the data with statistics, such as Min, max, Average, Sum and Sample data and send the data to CloudWatch B. Send all the data values to CloudWatch in a single command by separating them with a comma.CloudWatch will parse automatically C. Create one csv file of all the data and send a single file to CloudWatch D. It is not possible to send all the data in one call. Thus, it should be sent one by one. CloudWatch will aggregate the data automatically Answer: A Explanation: AWS CloudWatch supports the custom metrics. The user can always capture the custom data and upload the data to CloudWatch using CLI or APIs. The user can publish data to CloudWatch as single data points or as an aggregated set of data points called a statistic set using the command put-metric-data. It is recommended that when the user is having multiple data points per minute, he should aggregate the data so that it will minimize the number of calls to put-metric-data. In this case it will be single call to CloudWatch instead of 1000 calls if the data is aggregated. QUESTION: 266 A user is trying to create an EBS volume with the highest PIOPS supported by EBS. What is the minimum size of EBS required to have the maximum IOPS? A. 124 B. 150 C. 134 D. 128 Answer: C Explanation: A provisioned IOPS EBS volume can range in size from 10 GB to 1 TB and the user can provision up to 4000 IOPS per volume. The ratio of IOPS provisioned to the volume size requested should be a maximum of 30. QUESTION: 267 An organization is trying to create various IAM users. Which of the below mentioned AWS-SysOps 141http://www.examarea.comhttp://www.fravo.com options is not a valid IAM username? A. John.cloud B. john@cloud C. John=cloud D. john#cloud Answer: D Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. Whenever the organization is creating an IAM user, there should be a unique ID for each user. The names of users, groups, roles, instance profiles must be alphanumeric, including the following common characters: plus (+., equal (=., comma (,., period (.., at (@., and dash (-.. QUESTION: 268 A user is having data generated randomly based on a certain event. The user wants to upload that data to CloudWatch. It may happen that event may not have data generated for some period due to andomness. Which of the below mentioned options is a recommended option for this case? A. For the period when there is no data, the user should not send the data at all B. For the period when there is no data the user should send a blank value C. For the period when there is no data the user should send the value as 0 D. The user must upload the data to CloudWatch as having no data for some period will cause an error at CloudWatch monitoring Answer: C Explanation: AWS CloudWatch supports the custom metrics. The user can always capture the custom data and upload the data to CloudWatch using CLI or APIs. When the user data is more random and not generated at regular intervals, there can be a period which has no associated data. The user can either publish the zero (0. Value for that period or not publish the data at all. It is recommended that the user should publish zero instead of no value to monitor the health of the application. This is helpful in an alarm as well as in the generation of the sample data count. AWS-SysOps 142http://www.examarea.comhttp://www.fravo.com QUESTION: 269 A user is sending the data to CloudWatch using the CloudWatch API. The user is sending data 90 minutes in the future. What will CloudWatch do in this case? A. CloudWatch will accept the data B. It is not possible to send data of the future C. It is not possible to send the data manually to CloudWatch D. The user cannot send data for more than 60 minutes in the future Answer: A Explanation: With Amazon CloudWatch, each metric data point must be marked with a time stamp. The user can send the data using CLI but the time has to be in the UTC format. If the user does not provide the time, CloudWatch will take the data received time in the UTC timezone. The time stamp sent by the user can be up to two weeks in the past and up to two hours into the future. QUESTION: 270 A user wants to upload a complete folder to AWS S3 using the S3 Management console. How can the user perform this activity? A. Just drag and drop the folder using the flash tool provided by S3 B. Use the Enable Enhanced Folder option from the S3 console while uploading objects C. The user cannot upload the whole folder in one go with the S3 management console D. Use the Enable Enhanced Uploader option from the S3 console while uploading objects Answer: D Explanation: AWS S3 provides a console to upload objects to a bucket. The user can use the file upload screen to upload the whole folder in one go by clicking on the Enable Enhanced Uploader option. When the user uploads afolder, Amazon S3 uploads all the files and subfolders from the specified folder to the user’s bucket. It then assigns a key value that is a combination of the uploaded file name and the folder name. QUESTION: 271 AWS-SysOps 143http://www.examarea.comhttp://www.fravo.com Which of the below mentioned AWS RDS logs cannot be viewed from the console for MySQL? A. Error Log B. Slow Query Log C. Transaction Log D. General Log Answer: C Explanation: The user can view, download, and watch the database logs using the Amazon RDS console, the Command Line Interface (CLI., or the Amazon RDS API. For the MySQL RDS, the user can view the error log, slow querylog, and general logs. RDS does not support viewing the transaction logs. QUESTION: 272 A user has launched an EBS backed EC2 instance in the US-East-1a region. The user stopped the instance and started it back after 20 days. AWS throws up an ‘InsufficientInstanceCapacity’ error. What can be the possible reason for this? A. AWS does not have sufficient capacity in that availability zone B. AWS zone mapping is changed for that user account C. There is some issue with the host capacity on which the instance is launched D. The user account has reached the maximum EC2 instance limit Answer: A Explanation: When the user gets an ‘InsufficientInstanceCapacity’ error while launching or starting an EC2 instance, it means that AWS does not currently have enough available capacity to service the user request. If the user is requesting a large number of instances, there might not be enough server capacity to host them. The user can either try again later, by specifying a smaller number of instances or changing the availability zone if launching a fresh instance. QUESTION: 273 A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is true in this scenario? AWS-SysOps 144http://www.examarea.comhttp://www.fravo.com A. The AWS VPC will automatically create a NAT instance with the micro size B. VPC bounds the main route table with a private subnet and a custom route table with a public subnet C. The user has to manually create a NAT instance D. VPC bounds the main route table with a public subnet and a custom route table with a private subnet Answer: B Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet, the instances in the public subnet can receive inbound traffic directly from the internet, whereas the instances in the private subnet cannot. If these subnets are created with Wizard, AWS will create a NAT instance of a smaller or higher size, respectively. The VPC has an implied router and the VPC wizard updates the main route table used with the private subnet, creates a custom route table and associates it with the public subnet. QUESTION: 274 The CFO of a company wants to allow one of his employees to view only the AWS usage report page. Which of the below mentioned IAM policy statements allows the user to have access to the AWS usage report page? A. "Effect": "Allow", "Action": [“Describe”], "Resource": "Billing" B. "Effect": "Allow", "Action": ["AccountUsage], "Resource": "*" C. "Effect": "Allow", "Action": ["aws-portal:ViewUsage"], "Resource": "*" D. "Effect": "Allow", "Action": ["aws-portal: ViewBilling"], "Resource": "*" Answer: C Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. If the CFO wants to allow only AWS usage report page access, the policy for that IAM user will be as given below: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aws-portal:ViewUsage" AWS-SysOps 145http://www.examarea.comhttp://www.fravo.com ], "Resource": "*" } ] } QUESTION: 275 An organization has created 10 IAM users. The organization wants each of the IAM users to have access to a separate DyanmoDB table. All the users are added to the same group and the organization wants to setup a group level policy for this. How can the organization achieve this? A. Define the group policy and add a condition which allows the access based on the IAM name B. Create a DynamoDB table with the same name as the IAM user name and define the policy rule which grants access based on the DynamoDB ARN using a variable C. Create a separate DynamoDB database for each user and configure a policy in the group based on the DB variable D. It is not possible to have a group level policy which allows different IAM users to different DynamoDB Tables Answer: D Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. AWS DynamoDB has only tables and the organization cannot makeseparate databases. The organization should create a table with the same name as the IAM user name and use the ARN of DynamoDB as part of the group policy. The sample policy is shown below: { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["dynamodb:*"], "Resource": "arn:aws:dynamodb:region:account-number-withouthyphens: table/${aws:username}" } ] } QUESTION: 276 A user has configured an HTTPS listener on an ELB. The user has not configured any security policy which can help to negotiate SSL between the client and ELB. What will AWS-SysOps 146http://www.examarea.comhttp://www.fravo.com ELB do in this scenario? A. By default ELB will select the first version of the security policy B. By default ELB will select the latest version of the policy C. ELB creation will fail without a security policy D. It is not required to have a security policy since SSL is already installed Answer: B Explanation: Elastic Load Balancing uses a Secure Socket Layer (SSL. negotiation configuration which is known as a Security Policy. It is used to negotiate the SSL connections between a client and the load balancer. If the user has created an HTTPS/SSL listener without associating any security policy, Elastic Load Balancing will, bydefault, associate the latest version of the ELBSecurityPolicy-YYYY- MM with the load balancer. QUESTION: 277 A user is creating a Cloudformation stack. Which of the below mentioned limitations does not hold true for Cloudformation? A. One account by default is limited to 100 templates B. The user can use 60 parameters and 60 outputs in a single template C. The template, parameter, output, and resource description fields are limited to 4096 characters D. One account by default is limited to 20 stacks Answer: A Explanation: AWS Cloudformation is an application management tool which provides application modelling, deployment, configuration, management and related activities. The limitations given below apply to the Cloudformation template and stack. There are no limits to the number of templates but each AWS CloudFormation account is limited to a maximum of 20 stacks by default. The Template, Parameter, Output, and Resource description fields are limited to 4096 characters. The user can include up to 60 parameters and 60 outputs in a template. QUESTION: 278 A user has two EC2 instances running in two separate regions. The user is running an AWS-SysOps 147http://www.examarea.comhttp://www.fravo.com internal memory management tool, which captures the data and sends it to CloudWatch in US East, using a CLI with the same namespace and metric. Which of the below mentioned options is true with respect to the above statement? A. The setup will not work as CloudWatch cannot receive data across regions B. CloudWatch will receive and aggregate the data based on the namespace and metric C. CloudWatch will give an error since the data will conflict due to two sources D. CloudWatch will take the data of the server, which sends the data first Answer: B Explanation: Amazon CloudWatch does not differentiate the source of a metric when receiving custom data. If the user is publishing a metric with the same namespace and dimensions from different sources, CloudWatch will treat them as a single metric. If the data is coming with the same timezone within a minute, CloudWatch will aggregate the data. It treats these as a single metric, allowing the user to get the statistics, such as minimum, maximum, average, and the sum of all across all servers. QUESTION: 279 An organization has created a Queue named “modularqueue” with SQS. The organization is not performing any operations such as SendMessage, ReceiveMessage, DeleteMessage, GetQueueAttributes, SetQueueAttributes, AddPermission, and RemovePermission on the queue. What can happen in this scenario? A. AWS SQS sends notification after 15 days for inactivity on queue B. AWS SQS can delete queue after 30 days without notification C. AWS SQS marks queue inactive after 30 days D. AWS SQS notifies the user after 2 weeks and deletes the queue after 3 weeks. Answer: B Explanation: Amazon SQS can delete a queue without notification if one of the following actions hasn't been performed on it for 30 consecutive days: SendMessage, ReceiveMessage, DeleteMessage, GetQueueAttributes, SetQueueAttributes, AddPermission, and RemovePermission. QUESTION: 280 An organization has setup Auto Scaling with ELB. Due to some manual error, one of AWS-SysOps 148http://www.examarea.comhttp://www.fravo.com the instances got rebooted. Thus, it failed the Auto Scaling health check. Auto Scaling has marked it for replacement. How can the system admin ensure that the instance does not get terminated? A. Update the Auto Scaling group to ignore the instance reboot event B. It is not possible to change the status once it is marked for replacement C. Manually add that instance to the Auto Scaling group after reboot to avoid replacement D. Change the health of the instance to healthy using the Auto Scaling commands Answer: D Explanation: After an instance has been marked unhealthy by Auto Scaling, as a result of an Amazon EC2 or ELB health check, it is almost immediately scheduled for replacement as it will never automatically recover its health. If the user knows that the instance is healthy then he can manually call the SetInstanceHealth action (or the as-setinstance- health command from CLI. to set the instance's health status back to healthy. Auto Scaling will throw an error if the instance is already terminating or else it will mark it healthy. QUESTION: 281 A system admin wants to add more zones to the existing ELB. The system admin wants to perform this activity from CLI. Which of the below mentioned command helps the system admin to add new zones to the existing ELB? A. elb-enable-zones-for-lb B. elb-add-zones-for-lb C. It is not possible to add more zones to the existing ELB D. elb-configure-zones-for-lb Answer: A Explanation: The user has created an Elastic Load Balancer with the availability zone and wants to add more zones to the existing ELB. The user can do so in two ways: From the console or CLI, add new zones to ELB; QUESTION: 282 An organization is planning to create a user with IAM. They are trying to understand the limitations of IAM so that they can plan accordingly. Which of the below AWS-SysOps 149http://www.examarea.comhttp://www.fravo.com mentioned statements is not true with respect to the limitations of IAM? A. One IAM user can be a part of a maximum of 5 groups B. The organization can create 100 groups per AWS account C. One AWS account can have a maximum of 5000 IAM users D. One AWS account can have 250 roles Answer: A Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. The default maximums for each of the IAM entities is given below: Groups per AWS account: 100 Users per AWS account: 5000 Roles per AWS account: 250 Number of groups per user: 10 (that is, one user can be part of these many groups. QUESTION: 283 A user is planning to scale up an application by 8 AM and scale down by 7 PM daily using Auto Scaling. What should the user do in this case? A. Setup the scaling policy to scale up and down based on the CloudWatch alarms B. The user should increase the desired capacity at 8 AM and decrease it by 7 PM manually C. The user should setup a batch process which launches the EC2 instance at a specific time D. Setup scheduled actions to scale up or down at a specific time Answer: A Explanation: Auto Scaling based on a schedule allows the user to scale the application in response to predictable load changes. To configure the Auto Scaling group to scale based on a schedule, the user needs to create scheduled actions. A scheduled action tells Auto Scaling to perform a scaling action at a certain time in the future. QUESTION: 284 A user has created a VPC with two subnets: one public and one private. The user is planning to run the patch update for the instances in the private subnet. How can the instances in the private subnet connect to theinternet? AWS-SysOps 150http://www.examarea.comhttp://www.fravo.com A. Use the internet gateway with a private IP B. Allow outbound traffic in the security group for port 80 to allow internet updates C. The private subnet can never connect to the internet D. Use NAT with an elastic IP Answer: D Explanation: A Virtual Private Cloud (VPC. is a virtual network dedicated to the user’s AWS account. A user can create a subnet with VPC and launch instances inside that subnet. If the user has created two subnets (one private and one public., he would need a Network Address Translation (NAT. instance with the elastic IP address. This enables the instances in the private subnet to send requests to the internet (for example, to perform software updates.. QUESTION: 285 A user has configured an EC2 instance in the US-East-1a zone. The user has enabled detailed monitoring of the instance. The user is trying to get the data from CloudWatch using a CLI. Which of the below mentioned CloudWatch endpoint URLs should the user use? A. monitoring.us-east-1.amazonaws.com B. monitoring.us-east-1-a.amazonaws.com C. monitoring.us-east-1a.amazonaws.com D. cloudwatch.us-east-1a.amazonaws.com Answer: A Explanation: The CloudWatch resources are always region specific and they will have the end point as region specific. If the user is trying to access the metric in the US-East-1 region, the endpoint URL will be: monitoring.us-east- 1.amazonaws.com QUESTION: 286 A user has configured ELB with Auto Scaling. The user suspended the Auto Scaling AddToLoadBalancer (which adds instances to the load balancer. process for a while. What will happen to the instances launched during the suspension period? AWS-SysOps 151http://www.examarea.comhttp://www.fravo.com A. The instances will not be registered with ELB and the user has to manually register when the process is resumed B. The instances will be registered with ELB only once the process has resumed C. Auto Scaling will not launch the instance during this period due to process suspension D. It is not possible to suspend only the AddToLoadBalancer process Answer: A Explanation: Auto Scaling performs various processes, such as Launch, Terminate, add to Load Balancer etc. The user can also suspend the individual process. The AddToLoadBalancer process type adds instances to the load balancer when the instances are launched. If this process is suspended, Auto Scaling will launch the instances but will not add them to the load balancer. When the user resumes this process, Auto Scaling will resume adding new instances launched after resumption to the load balancer. However, it will not add running instances that were launched while the process was suspended; those instances must be added manually. QUESTION: 287 A sys admin has enabled a log on ELB. Which of the below mentioned activities are not captured by the log? A. Response processing time B. Front end processing time C. Backend processing time D. Request processing time Answer: B Explanation: Elastic Load Balancing access logs capture detailed information for all the requests made to the load balancer. Each request will have details, such as client IP, request path, ELB IP, time, and latencies. The time will have information, such as Request Processing time, Backend Processing time and Response Processing time. QUESTION: 288 A user has moved an object to Glacier using the life cycle rules. The user requests to restore the archive after 6 months. When the restore request is completed the user accesses that archive.Which of the below mentioned statements is not true in this condition? AWS-SysOps 152http://www.examarea.comhttp://www.fravo.com A. The archive will be available as an object for the duration specified by the user during the restoration request B. The restored object’s storage class will be RRS C. The user can modify the restoration period only by issuing a new restore request with the updated period D. The user needs to pay storage for both RRS (restored. and Glacier (Archive. Rates Answer: B Explanation: AWS Glacier is an archival service offered by AWS. AWS S3 provides lifecycle rules to archive and restore objects from S3 to Glacier. Once the object is archived their storage class will change to Glacier. If the user sends a request for restore, the storage class will still be Glacier for the restored object. The user will be paying for both the archived copy as well as for the restored object. The object is available only for the duration specified in the restore request and if the user wants to modify that period, he has to raise another restore request with the updated duration. QUESTION: 289 A user is running a batch process on EBS backed EC2 instances. The batch process starts a few instances to process hadoop Map reduce jobs which can run between 50 – 600 minutes or sometimes for more time. The user wants to configure that the instance gets terminated only when the process is completed. How can the user configure this with CloudWatch? A. Setup the CloudWatch action to terminate the instance when the CPU utilization is less than 5% B. Setup the CloudWatch with Auto Scaling to terminate all the instances C. Setup a job which terminates all instances after 600 minutes D. It is not possible to terminate instances automatically Answer: D Explanation: Amazon CloudWatch alarm watches a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The user can setup an action which terminates the instances when their CPU utilization is below a certain threshold for a certain period of time. The EC2 action can either terminate or stop the instance as part of the EC2 action. AWS-SysOps 153http://www.examarea.comhttp://www.fravo.com QUESTION: 290 A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at rest. If the user is supplying his own keys for encryption (SSE-C., what is recommended to the user for the purpose of security? A. The user should not use his own security key as it is not secure B. Configure S3 to rotate the user’s encryption key at regular intervals C. Configure S3 to store the user’s keys securely with SSL D. Keep rotating the encryption key manually at the client side Answer: D Explanation: AWS S3 supports client side or server side encryption to encrypt all data at Rest. The server side encryption can either have the S3 supplied AES-256 encryption key or the user can send the key along with each API call to supply his own encryption key (SSEC.. Since S3 does not store the encryption keys in SSE-C, it is recommended that the user should manage keys securely and keep rotating them regularly at the client side version. QUESTION: 291 A user runs the command “dd if=/dev/xvdf of=/dev/null bs=1M” on an EBS volume created from a snapshot and attached to a Linux instance. Which of the below mentioned activities is the user performing with the step given above? A. Pre warming the EBS volume B. Initiating the device to mount on the EBS volume C. Formatting the volume D. Copying the data from a snapshot to the device Answer: A Explanation: When the user creates an EBS volume and is trying to access it for the first time it will encounter reduced IOPS due to wiping or initiating of the block storage. To avoid this as well as achieve the best performance it is required to pre warm the EBS volume. For a volume created from a snapshot and attached with a Linux OS, the “dd” command pre warms the existing data on EBS and any restored snapshots of volumes that have been previously fully pre warmed. This command maintains incremental snapshots; AWS-SysOps 154http://www.examarea.comhttp://www.fravo.com however, because this operation is read-only, it does not pre warm unused space that has never been written to on the original volume. In the command “dd if=/dev/xvdf of=/dev/null bs=1M” , the parameter “if=input file” should be set to the drive that the user wishes to warm. The “of=output file” parameter should be set to the Linux null virtual device, /dev/null. The “bs” parameter sets the block size of the read operation; for optimal performance, this should be set to 1 MB. QUESTION: 292 A user has launched an EC2 Windows instance from an instance store backed AMI. The user wants to convert the AMI to an EBS backed AMI. How can the user convert it? A. Attach an EBS volume to the instance and unbundle all the AMI bundled data inside the EBS B. A Windows based instance store backed AMI cannot be converted to an EBS backed AMI C. It is not possible to convert an instance store backed AMI to an EBS backed AMI D. Attach an EBS volume and use the copy command to copy all the ephermal content to the EBS Volume Answer: B Explanation: Generally when a user has launched an EC2 instance from an instance store backed AMI, it can be converted to an EBS backed AMI provided the user has attached the EBS volume to the instance and unbundles the AMI data to it. However, if the instance is a Windows instance, AWS does not allow this. In this case, since the instance is a Windows instance, the user cannot convert it to an EBS backed AMI. QUESTION: 293 A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other? A. Destination : 20.0.0.0/24 and Target : VPC B. Destination : 20.0.0.0/16 and Target : ALL C. Destination : 20.0.0.0/0 and Target : ALL D. Destination : 20.0.0.0/16 and Target : Local AWS-SysOps 155http://www.examarea.comhttp://www.fravo.com Answer: A Explanation: A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet, the instances in the public subnet can receive inbound traffic directly from the Internet, whereas the instances in the private subnet cannot. If these subnets are created with Wizard, AWS will create two route tables and attach to the subnets. The main route table will have the entry “Destination: 20.0.0.0/24 and Target: Local”, which allows all instances in the VPC to communicate with each other. QUESTION: 294 A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. The bucket has both AWS.jpg and index.html objects. What does this policy define? "Statement": [{ "Sid": "Stmt1388811069831", "Effect": "Allow", "Principal": { "AWS": "*"}, "Action": [ "s3:GetObjectAcl", "s3:ListBucket", "s3:GetObject"], "Resource": [ "arn:aws:s3:::cloudacademy/*.jpg] }] A. It will make all the objects as well as the bucket public B. It will throw an error for the wrong action and does not allow to save the policy C. It will make the AWS.jpg object as public D. It will make the AWS.jpg as well as the cloudacademy bucket as public Answer: B Explanation: A sysadmin can grant permission to the S3 objects or the buckets to any user or make objects public using the bucket policy and user policy. Both use the JSON-based access policy language. Generally if user is defining the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be defined at the bucket level which allows the objects as well as the bucket to be public with a single policy applied to that bucket. In the below policy the action says “S3:ListBucket” for effect Allow and when there is no bucket name mentioned as a part of the resource, it will throw an error and not save the policy. "Statement": [{ "Sid": "Stmt1388811069831", "Effect": "Allow", "Principal": { "AWS": "*"}, "Action": [ "s3:GetObjectAcl", "s3:ListBucket", "s3:GetObject"], "Resource": [ AWS-SysOps 156http://www.examarea.comhttp://www.fravo.com "arn:aws:s3:::cloudacademy/*.jpg] }] QUESTION: 295 A user has launched an EC2 instance and deployed a production application in it. The user wants to prohibit any mistakes from the production team to avoid accidental termination. How can the user achieve this? A. The user can the set DisableApiTermination attribute to avoid accidental termination B. It is not possible to avoid accidental termination C. The user can set the Deletion termination flag to avoid accidental termination D. The user can set the InstanceInitiatedShutdownBehavior flag to avoid accidental termination Answer: A Explanation: It is always possible that someone can terminate an EC2 instance using the Amazon EC2 console, command line interface or API by mistake. If the admin wants to prevent the instance from being accidentally terminated, he can enable termination protection for that instance. The DisableApiTermination attribute controls whether the instance can be terminated using the console, CLI or API. By default, termination protection is disabled for an EC2 instance. When it is set it will not allow the user to terminate the instance from CLI, API or the console. QUESTION: 296 A user has created a launch configuration for Auto Scaling where CloudWatch detailed monitoring is disabled. The user wants to now enable detailed monitoring. How can the user achieve this? A. Update the Launch config with CLI to set InstanceMonitoringDisabled = false B. The user should change the Auto Scaling group from the AWS console to enable detailed monitoring C. Update the Launch config with CLI to set InstanceMonitoring.Enabled = true D. Create a new Launch Config with detail monitoring enabled and update the Auto Scaling group Answer: D Explanation: AWS-SysOps 157http://www.examarea.comhttp://www.fravo.com CloudWatch is used to monitor AWS as well as the custom services. To enable detailed instance monitoring for a new Auto Scaling group, the user does not need to take any extra steps. When the user creates the AutoScaling launch config as the first step for creating an Auto Scaling group, each launch configuration contains a flag named InstanceMonitoring.Enabled. The default value of this flag is true. When the user has created a launch configuration with InstanceMonitoring.Enabled = false it will involve multiple steps to enable detail monitoring. The steps are: Create a new Launch config with detailed monitoring enabled Update the Auto Scaling group with a new launch config Enable detail monitoring on each EC2 instance QUESTION: 297 A user is trying to pre-warm a blank EBS volume attached to a Linux instance. Which of the below mentioned steps should be performed by the user? A. There is no need to pre-warm an EBS volume B. Contact AWS support to pre-warm C. Unmount the volume before pre-warming D. Format the device Answer: C Explanation: When the user creates a new EBS volume or restores a volume from the snapshot, the back-end storage blocks are immediately allocated to the user EBS. However, the first time when the user is trying to access a block of the storage, it is recommended to either be wiped from the new volumes or instantiated from the snapshot (for restored volumes. before the user can access the block. This preliminary action takes time and can cause a 5 to 50 percent loss of IOPS for the volume when the block is accessed for the first time. To avoid this it is required to pre warm the volume. Pre- warming an EBS volume on a Linux instance requires that the user should unmount the blank device first and then write all the blocks on the device using a command, such as “dd”. QUESTION: 298 A user has launched an EC2 instance from an instance store backed AMI. The user has attached an additional instance store volume to the instance. The user wants to create an AMI from the running instance. Will the AMI have the additional instance store volume data? A. Yes, the block device mapping will have information about the additional instance store volume B. No, since the instance store backed AMI can have only the root volume bundled AWS-SysOps 158http://www.examarea.comhttp://www.fravo.com C. It is not possible to attach an additional instance store volume to the existing instance store backed AMI instance D. No, since this is ephermal storage it will not be a part of the AMI Answer: A Explanation: When the user has launched an EC2 instance from an instance store backed AMI and added an instance store volume to the instance in addition to the root device volume, the block device mapping for the new AMI contains the information for these volumes as well. In addition, the block device mappings for the instances those are launched from the new AMI will automatically contain information for these volumes. QUESTION: 299 A user has created an EBS volume of 10 GB and attached it to a running instance. The user is trying to access EBS for first time. Which of the below mentioned options is the correct statement with respect to a first time EBS access? A. The volume will show a size of 8 GB B. The volume will show a loss of the IOPS performance the first time C. The volume will be blank D. If the EBS is mounted it will ask the user to create a file system Answer: B Explanation: A user can create an EBS volume either from a snapshot or as a blank volume. If the volume is from a snapshot it will not be blank. The volume shows the right size only as long as it is mounted. This shows that the file system is created. When the user is accessing the volume the AWS EBS will wipe out the block storage or instantiate from the snapshot. Thus, the volume will show a loss of IOPS. It is recommended that the user should pre warm the EBS before use to achieve better IO. QUESTION: 300 A user has enabled termination protection on an EC2 instance. The user has also set Instance initiated shutdown behaviour to terminate. When the user shuts down the instance from the OS, what will happen? A. The OS will shutdown but the instance will not be terminated due to protection B. It will terminate the instance AWS-SysOps 159http://www.examarea.comhttp://www.fravo.com C. It will not allow the user to shutdown the instance from the OS D. It is not possible to set the termination protection when an Instance initiated shutdown is set to Terminate Answer: B Explanation: It is always possible that someone can terminate an EC2 instance using the Amazon EC2 console, command line interface or API by mistake. If the admin wants to prevent the instance from being accidentally terminated, he can enable termination protection for that instance. The user can also setup shutdown behaviour for an EBS backed instance to guide the instance on what should be done when he initiates shutdown from the OS using Instance initiated shutdown behaviour. If the instance initiated behaviour is set to terminate and the user shuts off the OS even though termination protection is enabled, it will still terminate the instance. QUESTION: 301 A user has deployed an application on an EBS backed EC2 instance. For a better performance of application, it requires dedicated EC2 to EBS traffic. How can the user achieve this? A. Launch the EC2 instance as EBS dedicated with PIOPS EBS B. Launch the EC2 instance as EBS enhanced with PIOPS EBS C. Launch the EC2 instance as EBS dedicated with PIOPS EBS D. Launch the EC2 instance as EBS optimized with PIOPS EBS Answer: D Explanation: Any application which has performance sensitive workloads and requires minimal variability with dedicated EC2 to EBS traffic should use provisioned IOPS EBS volumes, which are attached to an EBS-optimized EC2 instance or it should use an instance with 10 Gigabit network connectivity. Launching an instance that is EBSoptimized provides the user with a dedicated connection between the EC2 instance and the EBS volume. QUESTION: 302 A user has launched a Windows based EC2 instance. However, the instance has some issues and the user wants to check the log. When the user checks the Instance console output from the AWS console, what will it display? AWS-SysOps 160http://www.examarea.comhttp://www.fravo.com A. All the event logs since instance boot B. The last 10 system event log error C. The Windows instance does not support the console output D. The last three system events’ log errors Answer: D Explanation: The AWS EC2 console provides a useful tool called Console output for problem diagnosis. It is useful to find out any kernel issues, termination reasons or service configuration issues. For a Windows instance it lists the last three system event log errors. For Linux it displays the exact console output. QUESTION: 303 A user has deployed an application on his private cloud. The user is using his own monitoring tool. He wants to configure that whenever there is an error, the monitoring tool should notify him via SMS. Which of the below mentioned AWS services will help in this scenario? A. None because the user infrastructure is in the private cloud/ B. AWS SNS C. AWS SES D. AWS SMS Answer: B Explanation: Amazon Simple Notification Service (Amazon SNS. is a fast, flexible, and fully managed push messaging service. Amazon SNS can be used to make push notifications to mobile devices. Amazon SNS can deliver notifications by SMS text message or email to the Amazon Simple Queue Service (SQS. queues or to any HTTP endpoint. In this case user can use the SNS apis to send SMS. QUESTION: 304 A user is trying to setup a scheduled scaling activity using Auto Scaling. The user wants to setup the recurring schedule. Which of the below mentioned parameters is not required in this case? A. Maximum size AWS-SysOps 161http://www.examarea.comhttp://www.fravo.com B. Auto Scaling group name C. End time D. Recurrence value Answer: A Explanation: Auto Scaling based on a schedule allows the user to scale the application in response to predictable load changes. The user can also configure the recurring schedule action which will follow the Linux cron format. If the user is setting a recurring event, it is required that the user specifies the Recurrence value (in a cron format., end time (not compulsory but recurrence will stop after this. and the Auto Scaling group for which the scaling activity is to be scheduled. AWS-SysOps 162http://www.examarea.comhttp://www.fravo.com Quote Link to comment Share on other sites More sharing options...
katuri Posted January 25, 2017 Report Share Posted January 25, 2017 AWS Certified Solutions Architect - Associate Exam: AWS-SAA Edition: 3.0 AWS-SAA 1http://www.examarea.comhttp://www.fravo.com QUESTION: 1 An ERP application is deployed across multiple AZs in a single region. In the event of failure, the Recovery Time Objective (RTO) must be less than 3 hours, and the Recovery Point Objective (RPO) must be 15 minutes the customer realizes that data corruption occurred roughly 1.5 hours ago. What DR strategy could be used to achieve this RTO and RPO in the event of this kind of failure? A. Take hourly DB backups to S3, with transaction logs stored in S3 every 5 minutes. B. Use synchronous database master-slave replication between two availability zones. C. Take hourly DB backups to EC2 Instance store volumes with transaction logs stored In S3 every 5 minutes. D. Take 15 minute DB backups stored In Glacier with transaction logs stored in S3 every 5 minutes. Answer: C QUESTION: 2 You are designing a social media site and are considering how to mitigate distributed denial-of-service (DDoS) attacks. Which of the below are viable mitigation techniques? (Choose 3 answers) A. Add multiple elastic network interfaces (ENIs) to each EC2 instance to increase the network bandwidth. B. Use dedicated instances to ensure that each instance has the maximum performance possible. C. Use an Amazon CloudFront distribution for both static and dynamic content. D. Use an Elastic Load Balancer with auto scaling groups at the web. App and Amazon Relational Database Service (RDS) tiers E. Add alert Amazon CloudWatch to look for high Network in and CPU utilization. F. Create processes and capabilities to quickly add and remove rules to the instance OS firewall. Answer: B, D, F QUESTION: 3 You would like to create a mirror image of your production environment in another region for disaster recovery purposes. Which of the following AWS resources do not need to be recreated in the second region? (Choose 2 answers) AWS-SAA 2http://www.examarea.comhttp://www.fravo.com A. Route 53 Record Sets B. IM1 Roles C. Elastic IP Addresses (EIP) D. EC2 Key Pairs E. Launch configurations F. Security Groups Answer: A, C Reference:http://ltech.com/wpcontent/ themes/optimize/download/AWS_Disaster_Recovery.pdf (page 6) QUESTION: 4 You are responsible for a legacy web application whose server environment is approaching end of life You would like to migrate this application to AWS as quickly as possible, since the application environment currently has the following limitations: ✑ The VM's single 10GB VMDK is almost full ✑ Me virtual network interface still uses the 10Mbps driver, which leaves your 100Mbps WAN connection completely underutilized ✑ It is currently running on a highly customized. Windows VM within a VMware environment: ✑ You do not have me installation media This is a mission critical application with an RTO (Recovery Time Objective) of 8 hours. RPO (Recovery Point Objective) of 1 hour. How could you best migrate this application to AWS while meeting your business continuity requirements? A. Use the EC2 VM Import Connector for vCenter to import the VM into EC2. B. Use Import/Export to import the VM as an ESS snapshot and attach to EC2. C. Use S3 to create a backup of the VM and restore the data into EC2. D. Use me ec2-bundle-instance API to Import an Image of the VM into EC2 Answer: A QUESTION: 5 A newspaper organization has a on-premises application which allows the public to search its back catalogue and retrieve individual newspaper pages via a website written in Java They have scanned the old newspapers into JPEGs (approx 17TB) and used Optical Character Recognition (OCR) to populate a commercial search product. The hosting platform and software are now end of life and the AWS-SAA 3http://www.examarea.comhttp://www.fravo.com organization wants to migrate Its archive to AWS and produce a cost efficient architecture and still be designed for availability and durability Which is the most appropriate? A. Use S3 with reduced redundancy lo store and serve the scanned files, install the commercial search application on EC2 Instances and configure with autoscaling and an Elastic Load Balancer. B. Model the environment using CloudFormation use an EC2 instance running Apache webserver and an open source search application, stripe multiple standard EBS volumes together to store the JPEGs and search index. C. Use S3 with standard redundancy to store and serve the scanned files, use CloudSearch for query processing, and use Elastic Beanstalk to host the website across multiple availability zones. D. Use a single-AZ RDS MySQL instance lo store the search index 33d the JPEG images use an EC2 instance to serve the website and translate user queries into SQL. E. Use a CloudFront download distribution to serve the JPEGs to the end users and Install the current commercial search product, along with a Java Container Tor the website on EC2 instances and use Route53 with DNS round-robin. Answer: B QUESTION: 6 Your system recently experienced down time during the troubleshooting process. You found that a new administrator mistakenly terminated several production EC2 instances. Which of the following strategies will help prevent a similar situation in the future? The administrator still must be able to: - launch, start stop, and terminate development resources. - launch and start production instances. A. Create an IAM user, which is not allowed to terminate instances by leveraging production EC2 termination protection. B. Leverage resource based tagging along with an IAM user, which can prevent specific users from terminating production EC2 resources. C. Leverage EC2 termination protection and multi-factor authentication, which together require users to authenticate before terminating EC2 instances D. Create an IAM user and apply an IAM role which prevents users from terminating production EC2 instances. Answer: D QUESTION: 7 AWS-SAA 4http://www.examarea.comhttp://www.fravo.com You are designing Internet connectivity for your VPC. The Web servers must be available on the Internet. The application must have a highly available architecture. Which alternatives should you consider? (Choose 2 answers) A. Configure a NAT instance in your VPC Create a default route via the NAT instance and associate it with all subnets Configure a DNS A record that points to the NAT instance public IP address. B. Configure a CloudFront distribution and configure the origin to point to the private IP addresses of your Web servers Configure a Route53 CNAME record to your CloudFront distribution. C. Place all your web servers behind EL8 Configure a Route53 CNMIE to point to the ELB DNS name. D. Assign BPs to all web servers. Configure a Route53 record set with all EIPs. With health checks and DNS failover. E. Configure ELB with an EIP Place all your Web servers behind ELB Configure a Route53 A record that points to the EIP. Answer: B, C QUESTION: 8 An administrator is using Amazon CloudFormation to deploy a three tier web application that consists of a web tier and application tier that will utilize Amazon DynamoDB for storage when creating the CloudFormation template which of the following would allow the application instance access to the DynamoDB tables without exposing API credentials? A. Create an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and associate the Role to the application instances by referencing an instance profile. B. Use me Parameter section in the Cloud Formation template to nave the user input Access and Secret Keys from an already created IAM user that has me permissions required to read and write from the required DynamoDB table. C. Create an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and reference the Role in the instance profile property of the application instance. D. Create an identity and Access Management user in the CloudFormation template that has permissions to read and write from the required DynamoDB table, use the GetAtt function to retrieve the Access and secret keys and pass them to the application instance through user-data. Answer: C AWS-SAA 5http://www.examarea.comhttp://www.fravo.com QUESTION: 9 Your company has recently extended its datacenter into a VPC on AVVS to add burst computing capacity as needed Members of your Network Operations Center need to be able to go to the AWS Management Console and administer Amazon EC2 instances as necessary You don't want to create new IAM users for each NOC member and make those users sign in again to the AWS Management Console Which option below will meet the needs for your NOC members? A. Use OAuth 2 0 to retrieve temporary AWS security credentials to enable your NOC members to sign in to the AVVS Management Console. B. Use web Identity Federation to retrieve AWS temporary security credentials to enable your NOC members to sign in to the AWS Management Console. C. Use your on-premises SAML 2 O-compliant identity provider (IDP) to grant the NOC members federated access to the AWS Management Console via the AWS single sign-on (SSO) endpoint. D. Use your on-premises SAML2.0-compliam identity provider (IDP) to retrieve temporary security credentials to enable NOC members to sign in to the AWS Management Console. Answer: D QUESTION: 10 Your website is serving on-demand training videos to your workforce. Videos are uploaded monthly in high resolution MP4 format. Your workforce is distributed globally often on the move and using company-provided tablets that require the HTTP Live Streaming (HLS) protocol to watch a video. Your company has no video transcoding expertise and it required you may need to pay for a consultant. How do you implement the most cost-efficient architecture without compromising high availability and quality of video delivery'? A. Elastic Transcoder to transcode original high-resolution MP4 videos to HLS S3 to host videos with Utecycle Management to archive original flies to Glacier after a few days CloudFront to serve HLS transcoded videos from S3 B. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number or nodes depending on the length of the queue S3 to host videos with Lifecycle Management to archive all files to Glacier after a few days CloudFront to serve HLS transcoding videos from Glacier C. Elastic Transcoder to transcode original nigh-resolution MP4 videos to HLS EBS volumes to host videos and EBS snapshots to incrementally backup original rues after a few days CloudFront to serve HLS transcoded videos from EC2. D. A video transcoding pipeline running on EC2 using SOS to distribute tasks and Auto Scaling to adjust the number of nodes depending on the length of the queue E8S volumes to host videos and EBS snapshots to incrementally backup original files after a few days CloudFront to serve HLS transcoded videos from EC2 AWS-SAA 6http://www.examarea.comhttp://www.fravo.com Answer: A QUESTION: 11 You are implementing AWS Direct Connect. You intend to use AWS public service end points such as Amazon S3, across the AWS Direct Connect link. You want other Internet traffic to use your existing link to an Internet Service Provider. What is the correct way to configure AWS Direct connect for access to services such as Amazon S3? A. Configure a public Interface on your AWS Direct Connect link Configure a static route via your AWS Direct Connect link that points to Amazon S3 Advertise a default route to AWS using BGP. B. Create a private interface on your AWS Direct Connect link. Configure a static route via your AWS Direct connect link that points to Amazon S3 Configure specific routes to your network in your VPC. C. Create a public interface on your AWS Direct Connect link Redistribute BGP routes into your existing routing infrastructure advertise specific routes for your network to AWS. D. Create a private interface on your AWS Direct connect link. Redistribute BGP routes into your existing routing infrastructure and advertise a default route to AWS. Answer: C QUESTION: 12 You require the ability to analyze a customer's clickstream data on a website so they can do behavioral analysis. Your customer needs to know what sequence of pages and ads their customer clicked on. This data will be used in real time to modify the page layouts as customers click through the site to increase stickiness and advertising click-through. Which option meets the requirements for captioning and analyzing this data? A. Log clicks in weblogs by URL store to Amazon S3, and then analyze with Elastic MapReduce B. Push web clicks by session to Amazon Kinesis and analyze behavior using Kinesis workers C. Write click events directly to Amazon Redshift and then analyze with SQL D. Publish web clicks by session to an Amazon SQS queue men periodically drain these events to Amazon RDS and analyze with sol AWS-SAA 7http://www.examarea.comhttp://www.fravo.com Answer: B Reference:http://www.slideshare.net/AmazonWebServices/aws-webcast-introduction-toamazon- kinesis QUESTION: 13 You have deployed a web application targeting a global audience across multiple AWS Regions under the domain name.example.com. You decide to use Route53 Latency-Based Routing to serve web requests to users from the region closest to the user. To provide business continuity in the event of server downtime you configure weighted record sets associated with two web servers in separate Availability Zones per region. Dunning a DR test you notice that when you disable all web servers in one of the regions Route53 does not automatically direct all users to the other region. What could be happening? (Choose 2 answers) A. Latency resource record sets cannot be used in combination with weighted resource record sets. B. You did not setup an http health check tor one or more of the weighted resource record sets associated with me disabled web servers. C. The value of the weight associated with the latency alias resource record set in the region with the disabled servers is higher than the weight for the other region. D. One of the two working web servers in the other region did not pass its HTTP health check. E. You did not set "Evaluate Target Health" to "Yes" on the latency alias resource record set associated with example com in the region where you disabled the servers. Answer: B, D QUESTION: 14 A customer has established an AWS Direct Connect connection to AWS. The link is up and routes are being advertised from the customer's end, however the customer is unable to connect from EC2 instances inside its VPC to servers residing in its datacenter. Which of the following options provide a viable solution to remedy this situation? (Choose 2 answers) A. Add a route to the route table with an iPsec VPN connection as the target. B. Enable route propagation to the virtual pinnate gateway (VGW). C. Enable route propagation to the customer gateway (CGW). D. Modify the route table of all Instances using the 'route' command. E. Modify the Instances VPC subnet route table by adding a route back to the customer's on-premises environment. AWS-SAA 8http://www.examarea.comhttp://www.fravo.com Answer: A, C QUESTION: 15 Your company is in the process of developing a next generation pet collar that collects biometric information to assist families with promoting healthy lifestyles for their pets Each collar will push 30kb of biometric data In JSON format every 2 seconds to a collection platform that will process and analyze the data providing health trending information back to the pet owners and veterinarians via a web portal Management has tasked you to architect the collection platform ensuring the following requirements are met. Provide the ability for real-time analytics of the inbound biometric data Ensure processing of the biometric data is highly durable. Elastic and parallel The results of the analytic processing should be persisted for data mining Which architecture outlined below win meet the initial requirements for the collection platform? A. Utilize S3 to collect the inbound sensor data analyze the data from S3 with a daily scheduled Data Pipeline and save the results to a Redshift Cluster. B. Utilize Amazon Kinesis to collect the inbound sensor data, analyze the data with Kinesis clients and save the results to a Redshift cluster using EMR. C. Utilize SQS to collect the inbound sensor data analyze the data from SQS with Amazon Kinesis and save the results to a Microsoft SQL Server RDS instance. D. Utilize EMR to collect the inbound sensor data, analyze the data from EUR with Amazon Kinesis and save me results to DynamoDB. Answer: B QUESTION: 16 Your company produces customer commissioned one-of-a-kind skiing helmets combining nigh fashion with custom technical enhancements Customers can show off their Individuality on the ski slopes and have access to head-up-displays. GPS rear-view cams and any other technical innovation they wish to embed in the helmet. The current manufacturing process is data rich and complex including assessments to ensure that the custom electronics and materials used to assemble the helmets are to the highest standards Assessments are a mixture of human and automated assessments you need to add a new set of assessment to model the failure modes of the custom electronics using GPUs with CUDA. across a cluster of servers with low latency networking. What architecture would allow you to automate the existing process using a hybrid approach and ensure that the architecture can support the evolution of processes over time? A. Use AWS Data Pipeline to manage movement of data & meta-data and AWS-SAA 9http://www.examarea.comhttp://www.fravo.com assessments Use an auto-scaling group of G2 instances in a placement group. B. Use Amazon Simple Workflow (SWF) 10 manages assessments, movement of data & meta-data Use an auto-scaling group of G2 instances in a placement group. C. Use Amazon Simple Workflow (SWF) lo manages assessments movement of data & meta-data Use an auto-scaling group of C3 instances with SR-IOV (Single Root I/O Virtualization). D. Use AWS data Pipeline to manage movement of data & meta-data and assessments use auto-scaling group of C3 with SR-IOV (Single Root I/O virtualization). Answer: A QUESTION: 17 You are designing a data leak prevention solution for your VPC environment. You want your VPC Instances to be able to access software depots and distributions on the Internet for product updates. The depots and distributions are accessible via third party CONs by their URLs. You want to explicitly deny any other outbound connections from your VPC instances to hosts on the internet. Which of the following options would you consider? A. Configure a web ***** server in your VPC and enforce URL-based rules for outbound access Remove default routes. B. Implement security groups and configure outbound rules to only permit traffic to software depots. C. Move all your instances into private VPC subnets remove default routes from all routing tables and add specific routes to the software depots and distributions only. D. Implement network access control lists to all specific destinations, with an Implicit deny as a rule. Answer: A QUESTION: 18 You are looking to migrate your Development (Dev) and Test environments to AWS. You have decided to use separate AWS accounts to host each environment. You plan to link each accounts bill to a Master AWS account using Consolidated Billing. To make sure you Keep within budget you would like to implement a way for administrators in the Master account to have access to stop, delete and/or terminate resources in both the Dev and Test accounts. Identify which option will allow you to achieve this goal. A. Create IAM users in the Master account with full Admin permissions. Create AWS-SAA 10http://www.examarea.comhttp://www.fravo.com cross- account roles in the Dev and Test accounts that grant the Master account access to the resources in the account by inheriting permissions from the Master account. B. Create IAM users and a cross-account role in the Master account that grants full Admin permissions to the Dev and Test accounts. C. Create IAM users in the Master account Create cross-account roles in the Dev and Test accounts that have full Admin permissions and grant the Master account access. D. Link the accounts using Consolidated Billing. This will give IAM users in the Master account access to resources in the Dev and Test accounts Answer: A QUESTION: 19 You require the ability to analyze a large amount of data, which is stored on Amazon S3 using Amazon Elastic Map Reduce. You are using the cc2 8x large Instance type, whose CPUs are mostly idle during processing. Which of the below would be the most cost efficient way to reduce the runtime of the job? A. Create more smaller flies on Amazon S3. B. Add additional cc2 8x large instances by introducing a task group. C. Use smaller instances that have higher aggregate I/O performance. D. Create fewer, larger files on Amazon S3. Answer: C QUESTION: 20 You are designing a photo sharing mobile app the application will store all pictures in a single Amazon S3 bucket. Users will upload pictures from their mobile device directly to Amazon S3 and will be able to view and download their own pictures directly from Amazon S3. You want to configure security to handle potentially millions of users in the most secure manner possible. What should your server-side application do when a new user registers on the photo-sharing mobile application? A. Create a set of long-term credentials using AWS Security Token Service with appropriate permissions Store these credentials in the mobile app and use them to access Amazon S3. B. Record the user's Information in Amazon RDS and create a role in IAM with appropriate permissions. When the user uses their mobile app create temporary credentials using the AWS Security Token Service 'AssumeRole' function Store these credentials in the mobile app's memory and use them to access Amazon S3 AWS-SAA 11http://www.examarea.comhttp://www.fravo.com Generate new credentials the next time the user runs the mobile app. C. Record the user's Information In Amazon DynamoDB. When the user uses their mobile app create temporary credentials using AWS Security Token Service with appropriate permissions Store these credentials in the mobile app's memory and use them to access Amazon S3 Generate new credentials the next time the user runs the mobile app. D. Create IAM user. Assign appropriate permissions to the IAM user Generate an access key and secret key for the IAM user, store them in the mobile app and use these credentials to access Amazon S3. E. Create an IAM user. Update the bucket policy with appropriate permissions for the IAM user Generate an access Key and secret Key for the IAM user, store them In the mobile app and use these credentials to access Amazon S3. Answer: B QUESTION: 21 A corporate web application is deployed within an Amazon Virtual Private Cloud (VPC) and is connected to the corporate data center via an iPsec VPN. The application must authenticate against the on-premises LDAP server. After authentication, each logged-in user can only access an Amazon Simple Storage Space (S3) keyspace specific to that user. Which two approaches can satisfy these objectives? (Choose 2 answers) A. Develop an identity broker that authenticates against IAM security Token service to assume a IAM role in order to get temporary AWS security credentials The application calls the identity broker to get AWS temporary security credentials with access to the appropriate S3 bucket. B. The application authenticates against LOAP and retrieves the name of an IAMrole associated with the user. The application then calls the IAM Security Token Service to assume that IAM role The application can use the temporary credentials to access the appropriate S3 bucket. C. Develop an identity broker that authenticates against LDAP and then calls IAM Security Token Service to get IAM federated user credentials The application calls the identity broker to get IAM federated user credentials with access to the appropriate S3 bucket. D. The application authenticates against LDAP the application then calls the AWS identity and Access Management (IAM) Security service to log in to IAM using the LDAP credentials the application can use the IAM temporary credentials to access the appropriate S3 bucket. E. The application authenticates against IAM Security Token Service using the LDAP credentials the application uses those temporary AWS security credentials to access the appropriate S3 bucket. Answer: A, E AWS-SAA 12http://www.examarea.comhttp://www.fravo.com QUESTION: 22 An AWS customer runs a public blogging website. The site users upload two million blog entries a month The average blog entry size is 200 KB. The access rate to blog entries drops to negligible 6 months after publication and users rarely access a blog entry 1 year after publication. Additionally, blog entries have a high update rate during the first 3 months following publication, this drops to no updates after 6 months. The customer wants to use CloudFront to improve his user's load times. Which of the following recommendations would you make to the customer? A. Duplicate entries into two different buckets and create two separate CloudFront distributions where S3 access is restricted only to Cloud Front identity B. Create a CloudFront distribution with "US'Europe price class for US/Europe users and a different CloudFront distribution with All Edge Locations' for the remaining users. C. Create a CloudFront distribution with S3 access restricted only to the CloudFront identity and partition the blog entry's location in S3 according to the month it was uploaded to be used with CloudFront behaviors. D. Create a CloudFronl distribution with Restrict Viewer Access Forward Query string set to true and minimum TTL of 0. Answer: C QUESTION: 23 A customer has a 10 GB AWS Direct Connect connection to an AWS region where they have a web application hosted on Amazon Elastic Computer Cloud (EC2). The application has dependencies on an on-premises mainframe database that uses a BASE (Basic Available. Sort stale Eventual consistency) rather than an ACID (Atomicity. Consistency isolation. Durability) consistency model. The application is exhibiting undesirable behavior because the database is not able to handle the volume of writes. How can you reduce the load on your on-premises database resources in the most cost-effective way? A. Use an Amazon Elastic Map Reduce (EMR) S3DistCp as a synchronization mechanism between the on-premises database and a Hadoop cluster on AWS. B. Modify the application to write to an Amazon SQS queue and develop a worker process to flush the queue to the on-premises database. C. Modify the application to use DynamoDB to feed an EMR cluster which uses a map function to write to the on-premises database. D. Provision an RDS read-replica database on AWS to handle the writes and synchronize the two databases using Data Pipeline. AWS-SAA 13http://www.examarea.comhttp://www.fravo.com Answer: A Reference:https://aws.amazon.com/blogs/aws/category/amazon-elastic-map-reduce/ QUESTION: 24 You have an application running on an EC2 Instance which will allow users to download flies from a private S3 bucket using a pre-assigned URL. Before generating the URL the application should verify the existence of the file in S3. How should the application use AWS credentials to access the S3 bucket securely? A. Use the AWS account access Keys the application retrieves the credentials from the source code of the application. B. Create a IAM user for the application with permissions that allow list access to the S3 bucket launch the instance as the IAM user and retrieve the IAM user's credentials from the EC2 instance user data. C. Create an IAM role for EC2 that allows list access to objects in the S3 bucket. Launch the instance with the role, and retrieve the role's credentials from the EC2 Instance metadata D. Create an IAM user for the application with permissions that allow list access to the S3 bucket. The application retrieves the IAM user credentials from a temporary directory with permissions that allow read access only to the application user. Answer: B QUESTION: 25 You are the new IT architect in a company that operates a mobile sleep tracking application When activated at night, the mobile app is sending collected data points of 1 kilobyte every 5 minutes to your backend The backend takes care of authenticating the user and writing the data points into an Amazon DynamoDB table. Every morning, you scan the table to extract and aggregate last night's data on a per user basis, and store the results in Amazon S3. Users are notified via Amazon SMS mobile push notifications that new data is available, which is parsed and visualized by (The mobile app Currently you have around 100k users who are mostly based out of North America. You have been tasked to optimize the architecture of the backend system to lower cost what would you recommend? (Choose 2 answers) A. Create a new Amazon DynamoDB (able each day and drop the one for the previous day after its data is on Amazon S3. B. Have the mobile app access Amazon DynamoDB directly instead of JSON AWS-SAA 14http://www.examarea.comhttp://www.fravo.com files stored on Amazon S3. C. Introduce an Amazon SQS queue to buffer writes to the Amazon DynamoDB table and reduce provisioned write throughput. D. Introduce Amazon Elasticache lo cache reads from the Amazon DynamoDB table and reduce provisioned read throughput. E. Write data directly into an Amazon Redshift cluster replacing both Amazon DynamoDB and Amazon S3. Answer: B, D QUESTION: 26 Your company is getting ready to do a major public announcement of a social media site on AWS. The website is running on EC2 instances deployed across multiple Availability Zones with a Multi-AZ RDS MySQL Extra Large DB Instance. The site performs a high number of small reads and writes per second and relies on an eventual consistency model. After comprehensive tests you discover that there is read contention on RDS MySQL. Which are the best approaches to meet these requirements? (Choose 2 answers) A. Deploy ElasticCache in-memory cache running in each availability zone B. Implement sharding to distribute load to multiple RDS MySQL instances C. Increase the RDS MySQL Instance size and Implement provisioned IOPS D. Add an RDS MySQL read replica in each availability zone Answer: A, C QUESTION: 27 Your company has an on-premises multi-tier PHP web application, which recently experienced downtime due to a large burst In web traffic due to a company announcement Over the coming days, you are expecting similar announcements to drive similar unpredictable bursts, and are looking to find ways to quickly improve your infrastructures ability to handle unexpected increases in traffic. The application currently consists of 2 tiers a web tier which consists of a load balancer and several Linux Apache web servers as well as a database tier which hosts a Linux server hosting a MySQL database. Which scenario below will provide full site functionality, while helping to improve the ability of your application in the short timeframe required? A. Offload traffic from on-premises environment Setup a CloudFront distribution and configure CloudFront to cache objects from a custom origin Choose to customize your object cache behavior, and select a TTL that objects should exist in cache. B. Migrate to AWS Use VM import ‘Export to quickly convert an on-premises AWS-SAA 15http://www.examarea.comhttp://www.fravo.com web server to an AMI create an Auto Scaling group, which uses the imported AMI to scale the web tier based on incoming traffic Create an RDS read replica and setup replication between the RDS instance and on-premises MySQL server to migrate the database. C. Failover environment: Create an S3 bucket and configure it tor website hosting Migrate your DNS to Route53 using zone (lie import and leverage Route53 DNS failover to failover to the S3 hosted website. D. Hybrid environment Create an AMI which can be used of launch web serfers in EC2 Create an Auto Scaling group which uses the * AMI to scale the web tier based on incoming traffic Leverage Elastic Load Balancing to balance traffic between on-premises web servers and those hosted in AWS. Answer: C QUESTION: 28 Your company policies require encryption of sensitive data at rest. You are considering the possible options for protecting data while storing it at rest on an EBS data volume, attached to an EC2 instance. Which of these options would allow you to encrypt your data at rest? (Choose 3 answers) A. Implement third party volume encryption tools B. Do nothing as EBS volumes are encrypted by default C. Encrypt data inside your applications before storing it on EBS D. Encrypt data using native data encryption drivers at the file system level E. Implement SSL/TLS for all services running on the server Answer: C, D, E QUESTION: 29 A benefits enrollment company is hosting a 3-tier web application running in a VPC on AWS which includes a NAT (Network Address Translation) instance in the public Web tier. There is enough provisioned capacity for the expected workload tor the new fiscal year benefit enrollment period plus some extra overhead Enrollment proceeds nicely for two days and then the web tier becomes unresponsive, upon investigation using CloudWatch and other monitoring tools it is discovered that there is an extremely large and unanticipated amount of inbound traffic coming from a set of 15 specific IP addresses over port 80 from a country where the benefits company has no customers. The web tier instances are so overloaded that benefit enrollment administrators cannot even SSH into them. Which activity would be useful in defending against this attack? A. Create a custom route table associated with the web tier and block the AWS-SAA 16http://www.examarea.comhttp://www.fravo.com attacking IP addresses from the IGW (internet Gateway) B. Change the EIP (Elastic IP Address) of the NAT instance in the web tier subnet and update the Main Route Table with the new EIP C. Create 15 Security Group rules to block the attacking IP addresses over port 80 D. Create an inbound NACL (Network Access control list) associated with the web tier subnet with deny rules to block the attacking IP addresses Answer: A QUESTION: 30 An enterprise wants to use a third-party SaaS application. The SaaS application needs to have access to issue several API commands to discover Amazon EC2 resources running within the enterprise's account The enterprise has internal security policies that require any outside access to their environment must conform to the principles of least privilege and there must be controls in place to ensure that the credentials used by the SaaS vendor cannot be used by any other third party. Which of the following would meet all of these conditions? A. From the AWS Management Console, navigate to the Security Credentials page and retrieve the access and secret key for your account. B. Create an IAM user within the enterprise account assign a user policy to the IAM user that allows only the actions required by the SaaS application create a new access and secret key for the user and provide these credentials to the SaaS provider. C. Create an IAM role for cross-account access allows the SaaS provider's account to assume the role and assign it a policy that allows only the actions required by the SaaS application. D. Create an IAM role for EC2 instances, assign it a policy mat allows only the actions required tor the Saas application to work, provide the role ARM to the SaaS provider to use when launching their application instances. Answer: D QUESTION: 31 You're running an application on-premises due to its dependency on non-x86 hardware and want to use AWS for data backup. Your backup application is only able to write to POSIX-compatible block-based storage. You have 140TB of data and would like to mount it as a single folder on your file server Users must be able to access portions of this data while the backups are taking place. What backup solution would be most appropriate for this use case? A. Use Storage Gateway and configure it to use Gateway Cached volumes. AWS-SAA 17http://www.examarea.comhttp://www.fravo.com B. Configure your backup software to use S3 as the target for your data backups. C. Configure your backup software to use Glacier as the target for your data backups. D. Use Storage Gateway and configure it to use Gateway Stored volumes. Answer: C QUESTION: 32 Your customer wishes to deploy an enterprise application to AWS which will consist of several web servers, several application servers and a small (50GB) Oracle database information is stored, both in the database and the file systems of the various servers. The backup system must support database recovery whole server and whole disk restores, and individual file restores with a recovery time of no more than two hours. They have chosen to use RDS Oracle as the database Which backup architecture will meet these requirements? A. Backup RDS using automated daily DB backups Backup the EC2 instances using AMIs and supplement with file-level backup to S3 using traditional enterprise backup software to provide file level restore B. Backup RDS using a Multi-AZ Deployment Backup the EC2 instances using Amis, and supplement by copying file system data to S3 to provide file level restore. C. Backup RDS using automated daily DB backups Backup the EC2 instances using EBS snapshots and supplement with file-level backups to Amazon Glacier using traditional enterprise backup software to provide file level restore D. Backup RDS database to S3 using Oracle RMAN Backup the EC2 instances using Amis, and supplement with EBS snapshots for individual volume restore. Answer: C Reference:http://www.boyter.org/wp-content/uploads/2014/12/Backup-And-Recovery- Approaches-Using-Aws.pdf QUESTION: 33 An International company has deployed a multi-tier web application that relies on DynamoDB in a single region For regulatory reasons they need disaster recovery capability In a separate region with a Recovery Time Objective of 2 hours and a Recovery Point Objective of 24 hours They should synchronize their data on a regular basis and be able to provision me web application rapidly using CloudFormation. The objective is to minimize changes to the existing web application, control the throughput of DynamoDB used for the synchronization of data and synchronize only the modified elements. Which design would you choose to meet these requirements? AWS-SAA 18http://www.examarea.comhttp://www.fravo.com A. Use AWS data Pipeline to schedule a DynamoDB cross region copy once a day. create a Lastupdated' attribute in your DynamoDB table that would represent the timestamp of the last update and use it as a filter. B. Use EMR and write a custom script to retrieve data from DynamoDB in the current region using a SCAN operation and push it to QynamoDB in the second region. C. Use AWS data Pipeline to schedule an export of the DynamoDB table to S3 in the current region once a day then schedule another task immediately after it that will import data from S3 to DynamoDB in the other region. D. Send also each Ante into an SQS queue in me second region; use an autoscaiing group behind the SQS queue to replay the write in the second region. Answer: C QUESTION: 34 You are tasked with moving a legacy application from a virtual machine running Inside your datacenter to an Amazon VPC Unfortunately this app requires access to a number of on- premises services and no one who configured the app still works for your company. Even worse there's no documentation for it. What will allow the application running inside the VPC to reach back and access its internal dependencies without being reconfigured? (Choose 3 answers) A. An AWS Direct Connect link between the VPC and the network housing the internal services. B. An Internet Gateway to allow a VPN connection. C. An Elastic IP address on the VPC instance D. An IP address space that does not conflict with the one on-premises E. Entries in Amazon Route 53 that allow the Instance to resolve its dependencies' IP addresses F. A VM Import of the current virtual machine Answer: A, C, F QUESTION: 35 A read only news reporting site with a combined web and application tier and a database tier that receives large and unpredictable traffic demands must be able to respond to these traffic fluctuations automatically. What AWS services should be used meet these requirements? A. Stateless instances for the web and application tier synchronized using AWS-SAA 19http://www.examarea.comhttp://www.fravo.com Elasticache Memcached in an autoscaimg group monitored with CloudWatch. And RDSwith read replicas B. Stateful instances for me web and application tier in an autoscaling group monitored with CloudWatch and RDS with read replicas C. Stateful instances for the web and application tier in an autoscaling group monitored with CloudWatch. And multi-AZ RDS D. Stateless instances for the web and application tier synchronized using ElastiCache Memcached in an autoscaling group monitored with CloudWatch and multi-AZ RDS Answer: B QUESTION: 36 Your company currently has a 2-tier web application running in an on-premises data center. You have experienced several infrastructure failures in the past two months resulting in significant financial losses. Your CIO is strongly agreeing to move the application to AWS. While working on achieving buy-in from the other company executives, he asks you to develop a disaster recovery plan to help improve Business continuity in the short term. He specifies a target Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour or less. He also asks you to implement the solution within 2 weeks. Your database is 200GB in size and you have a 20Mbps Internet connection. How would you do this while minimizing costs? A. Create an EBS backed private AMI which includes a fresh install or your application. Setup a script in your data center to backup the local database every 1 hour and to encrypt and copy the resulting file to an S3 bucket using multi-part upload. B. Install your application on a compute-optimized EC2 instance capable of supporting the application's average load synchronously replicate transactions from your on-premises database to a database instance in AWS across a secure Direct Connect connection. C. Deploy your application on EC2 instances within an Auto Scaling group across multiple availability zones asynchronously replicate transactions from your onpremises database to a database instance in AWS across a secure VPN connection. D. Create an EBS backed private AMI that includes a fresh install of your application. Develop a Cloud Formation template which includes your Mil and the required EC2. Auto- Scaling and ELB resources to support deploying the application across Multiple-Ability Zones. Asynchronously replicate transactions from your on-premises database to a database instance in AWS across a secure VPN connection. Answer: A AWS-SAA 20http://www.examarea.comhttp://www.fravo.com QUESTION: 37 You have recently joined a startup company building sensors to measure street noise and air quality in urban areas. The company has been running a pilot deployment of around 100 sensors for 3 months each sensor uploads 1KB of sensor data every minute to a backend hosted on AWS. During the pilot, you measured a peak or 10 IOPS on the database, and you stored an average of 3GB of sensor data per month in the database.The current deployment consists of a load-balanced auto scaled Ingestion layer using EC2 instances and a PostgreSQL RDS database with 500GB standard storage. The pilot is considered a success and your CEO has managed to get the attention or some potential investors. The business plan requires a deployment of at least 1O0K sensors which needs to be supported by the backend. You also need to store sensor data for at least two years to be able to compare year over year Improvements. To secure funding, you have to make sure that the platform meets these requirements and leaves room for further scaling. Which setup win meet the requirements? A. Add an SOS queue to the ingestion layer to buffer writes to the RDS instance B. Ingest data into a DynamoDB table and move old data to a Redshift cluster C. Replace the RDS instance with a 6 node Redshift cluster with 96TB of storage D. Keep the current architecture but upgrade RDS storage to 3TB and 10K provisioned IOPS Answer: C QUESTION: 38 Exhibit AWS-SAA 21http://www.examarea.comhttp://www.fravo.com Refer to the architecture diagram above of a batch processing solution using Simple Queue Service (SOS) to set up a message queue between EC2 instances which are used as batch processors Cloud Watch monitors the number of Job requests (queued messages) and an Auto Scaling group adds or deletes batch servers automatically based on parameters set in Cloud Watch alarms. You can use this architecture to implement which of the following features in a cost effective and efficient manner? A. Reduce the overall lime for executing jobs through parallel processing by allowing a busy EC2 instance that receives a message to pass it to the next instance in a daisy-chain setup. B. Implement fault tolerance against EC2 instance failure since messages would remain in SQS and worn can continue with recovery of EC2 instances implement fault tolerance against SQS failure by backing up messages to S3. C. Implement message passing between EC2 instances within a batch by exchanging messages through SOS. D. Coordinate number of EC2 instances with number of job requests automatically thus Improving cost effectiveness. E. Handle high priority jobs before lower priority jobs by assigning a priority metadata field to SQS messages. Answer: B AWS-SAA 22http://www.examarea.comhttp://www.fravo.com QUESTION: 39 A company is building a voting system for a popular TV show, viewers win watch the performances then visit the show's website to vote for their favorite performer. It is expected that in a short period of time after the show has finished the site will receive millions of visitors. The visitors will first login to the site using their Amazon.com credentials and then submit their vote. After the voting is completed the page will display the vote totals. The company needs to build the site such that can handle the rapid influx of traffic while maintaining good performance but also wants to keep costs to a minimum. Which of the design patterns below should they use? A. Use CloudFront and an Elastic Load balancer in front of an auto-scaled set of web servers, the web servers will first can the Login With Amazon service to authenticate the user then process the users vote and store the result into a multi- AZ Relational Database Service instance. B. Use CloudFront and the static website hosting feature of S3 with the Javascript SDK to call the Login With Amazon service to authenticate the user, use IAM Roles to gain permissions to a DynamoDB table to store the users vote. C. Use CloudFront and an Elastic Load Balancer in front of an auto-scaled set of web servers, the web servers will first call the Login with Amazon service to authenticate the user, the web servers will process the users vote and store the result into a DynamoDB table using IAM Roles for EC2 instances to gain permissions to the DynamoDB table. D. Use CloudFront and an Elastic Load Balancer in front of an auto-scaled set of web servers, the web servers will first call the Login. With Amazon service to authenticate the user, the web servers win process the users vote and store the result into an SQS queue using IAM Roles for EC2 Instances to gain permissions to the SQS queue. A set of application servers will then retrieve the items from the queue and store the result into a DynamoDB table. Answer: D QUESTION: 40 You have a periodic Image analysis application that gets some files In Input analyzes them and tor each file writes some data in output to a ten file the number of files in input per day is high and concentrated in a few hours of the day. Currently you have a server on EC2 with a large EBS volume that hosts the input data and the results it takes almost 20 hours per day to complete the process What services could be used to reduce the elaboration time and improve the availability of the solution? AWS-SAA 23http://www.examarea.comhttp://www.fravo.com A. S3 to store I/O files. SQS to distribute elaboration commands to a group of hosts working in parallel. Auto scaling to dynamically size the group of hosts depending on the length of the SQS queue B. EBS with Provisioned IOPS (PIOPS) to store I/O files. SNS to distribute elaboration commands to a group of hosts working in parallel Auto Scaling to dynamically size the group of hosts depending on the number of SNS notifications C. S3 to store I/O files, SNS to distribute evaporation commands to a group of hosts working in parallel. Auto scaling to dynamically size the group of hosts depending on the number of SNS notifications D. EBS with Provisioned IOPS (PIOPS) to store I/O files SOS to distribute elaboration commands to a group of hosts working in parallel Auto Scaling to dynamically size the group ot hosts depending on the length of the SQS queue. Answer: C QUESTION: 41 You've been brought in as solutions architect to assist an enterprise customer with their migration of an e-commerce platform to Amazon Virtual Private Cloud (VPC) The previous architect has already deployed a 3-tier VPC. The configuration is as follows: VPC vpc-2f8t>C447 IGVV ig-2d8bc445 NACL acl-2080c448 Subnets and Route Tables: Web server’s subnet-258Dc44d Application server’s suDnet-248bc44c Database server’s subnet-9189c6f9 Route Tables: rrb-218DC449 rtb-238bc44b Associations: subnet-258bc44d: rtb-2i8bc449 Subnet-248DC44C rtb-238tX44b subnet- 9189c6f9 rtb-238Dc 44b You are now ready to begin deploying EC2 instances into the VPC Web servers must have direct access to the internet Application and database servers cannot have direct access to the internet. Which configuration below will allow you the ability to remotely administer your application and database servers, as well as allow these servers to retrieve updates from the Internet? A. Create a bastion and NAT Instance in subnet-248bc44c and add a route from rtb- 238bc44b to subnet-258bc44d. B. Add a route from rtD-238bc44D to igw-2d8bc445 and add a bastion and NAT instance within suonet-248bc44c. C. Create a bastion and MAT Instance In subnet-258bc44d. Add a route from rtb- 238bc44b to igw-2d8bc445. And a new NACL that allows access between subnet- 258bc44d and subnet-248bc44c. D. Create a bastion and mat instance in suDnet-258Dc44d and add a route from rtD- 238Dc44D to the mat instance. AWS-SAA 24http://www.examarea.comhttp://www.fravo.com Answer: A QUESTION: 42 You are designing an intrusion detection prevention (IDS/IPS) solution for a customer web application in a single VPC. You are considering the options for implementing IOS IPS protection for traffic coming from the Internet. Which of the following options would you consider? (Choose 2 answers) A. Implement IDS/IPS agents on each Instance running In VPC B. Configure an instance in each subnet to switch its network interface card to promiscuous mode and analyze network traffic. C. Implement Elastic Load Balancing with SSL listeners In front of the web applications D. Implement a reverse ***** layer in front of web servers and configure IDS/IPS agents on each reverse ***** server. Answer: C, D QUESTION: 43 Your company previously configured a heavily used, dynamically routed VPN connection between your on-premises data center and AWS. You recently provisioned a DirectConnect connection and would like to start using the new connection. After configuring DirectConnect settings in the AWS Console, which of the following options win provide the most seamless transition for your users? A. Delete your existing VPN connection to avoid routing loops configure your DirectConnect router with the appropriate settings and verity network traffic is leveraging DirectConnect. B. Configure your DireclConnect router with a higher 8GP priority man your VPN router, verify network traffic is leveraging Directconnect and then delete your existing VPN connection. C. Update your VPC route tables to point to the DirectConnect connection configure your DirectConnect router with the appropriate settings verify network traffic is leveraging DirectConnect and then delete the VPN connection. D. Configure your DireclConnect router, update your VPC route tables to point to the DirectConnect connection, configure your VPN connection with a higher BGP pointy. And verify network traffic is leveraging the DirectConnect connection. Answer: D QUESTION: 44 AWS-SAA 25http://www.examarea.comhttp://www.fravo.com You are migrating a legacy client-server application to AWS The application responds to a specific DNS domain (e g www example com) and has a 2-tier architecture, with multiple application servers and a database server Remote clients use TCP to connect to the application servers. The application servers need to know the IP address of the clients in order to function properly and are currently taking that information from the TCP socket A Multi-AZ RDS MySQL instance will be used for the database. During the migration you can change the application code but you have to file a change request. How would you implement the architecture on AWS In order to maximize scalability and high ability? A. File a change request to implement ***** Protocol support In the application Use an EL8 with a TCP Listener and ***** Protocol enabled to distribute load on two application servers in different AZs. B. File a change request to Implement Cross-Zone support in the application Use an EL8 with a TCP Listener and Cross-Zone Load Balancing enabled, two application servers in different AZs. C. File a change request to implement Latency Based Routing support in the application Use Route 53 with Latency Based Routing enabled to distribute load on two application servers in different AZs. D. File a change request to implement Alias Resource support in the application Use Route 53 Alias Resource Record to distribute load on two application servers in different AZs. Answer: D QUESTION: 45 Your company has HQ in Tokyo and branch offices all over the world and is using a logistics software with a multi-regional deployment on AWS in Japan, Europe and USA. The logistic software has a 3-tier architecture and currently uses MySQL 5.6 for data persistence. Each region has deployed its own database In the HQ region you run an hourly batch process reading data from every region to compute cross-regional reports that are sent by email to all offices this batch process must be completed as fast as possible to quickly optimize logistics how do you build the database architecture in order to meet the requirements’? A. For each regional deployment, use RDS MySQL with a master in the region and a read replica in the HQ region B. For each regional deployment, use MySQL on EC2 with a master in the region and send hourly EBS snapshots to the HQ region C. For each regional deployment, use RDS MySQL with a master in the region and send hourly RDS snapshots to the HQ region D. For each regional deployment, use MySQL on EC2 with a master in the region and use S3 to copy data files hourly to the HQ region E. Use Direct Connect to connect all regional MySQL deployments to the HQ AWS-SAA 26http://www.examarea.comhttp://www.fravo.com region and reduce network latency for the batch process Answer: A QUESTION: 46 You have deployed a three-tier web application in a VPC with a CIOR block of 10 0 0 0/28 You initially deploy two web servers, two application servers, two database servers and one NAT instance tor a total of seven EC2 instances The web. Application and database servers are deployed across two availability zones (AZs). You also deploy an ELB in front of the two web servers, and use Route53 for DNS Web (raffle gradually increases in the first few days following the deployment, so you attempt to double the number of instances in each tier of the application to handle the new load unfortunately some of these new instances fail to launch. Which of the following could De the root caused? (Choose 2 answers) A. The Internet Gateway (IGW) of your VPC has scaled-up adding more instances to handle the traffic spike, reducing the number of available private IP addresses for new instance launches. B. AWS reserves one IP address In each subnet's CIDR block for Route53 so you do not have enough addresses left to launch all of the new EC2 instances. C. AWS reserves the first and the last private IP address in each subnet's CIDR block so you do not have enough addresses left to launch all of the new EC2 instances. D. The ELB has scaled-up. Adding more instances to handle the traffic reducing the number of available private IP addresses for new instance launches. E. AWS reserves the first tour and the last IP address in each subnet's CIDR block so you do not have enough addresses left to launch all of the new EC2 instances. Answer: D, E QUESTION: 47 An AWS customer is deploying an application mat is composed of an AutoScaling group of EC2 Instances. The customers security policy requires that every outbound connection from these instances to any other service within the customers Virtual Private Cloud must be authenticated using a unique x 509 certificate that contains the specific instance-id. In addition an x 509 certificates must Designed by the customer's Key management service in order to be trusted for authentication. Which of the following configurations will support these requirements? A. Configure an IAM Role that grants access to an Amazon S3 object containing a signed certificate and configure me Auto Scaling group to launch instances with AWS-SAA 27http://www.examarea.comhttp://www.fravo.com this role Have the instances bootstrap get the certificate from Amazon S3 upon first boot. B. Embed a certificate into the Amazon Machine Image that is used by the Auto Scaling group Have the launched instances generate a certificate signature request with the instance's assigned instance-id to the Key management service for signature. C. Configure the Auto Scaling group to send an SNS notification of the launch of a new instance to the trusted key management service. Have the Key management service generate a signed certificate and send it directly to the newly launched instance. D. Configure the launched instances to generate a new certificate upon first boot Have the Key management service poll the AutoScaling group for associated instances and send new instances a certificate signature (hat contains the specific instance-id. Answer: A QUESTION: 48 Company B is launching a new game app for mobile devices. Users will log into the game using their existing social media account to streamline data capture. Company B would like to directly save player data and scoring information from the mobile app to a DynamoDS table named Score Data When a user saves their game the progress data will be stored to the Game state S3 bucket. What is the best approach for storing data to DynamoDB and S3? A. Use an EC2 Instance that is launched with an EC2 role providing access to the Score Data DynamoDB table and the GameState S3 bucket that communicates with the mobile app via web services. B. Use temporary security credentials that assume a role providing access to the Score Data DynamoDB table and the Game State S3 bucket using web identity federation. C. Use Login with Amazon allowing users to sign in with an Amazon account providing the mobile app with access to the Score Data DynamoDB table and the Game State S3 bucket. D. Use an IAM user with access credentials assigned a role providing access to the Score Data DynamoDB table and the Game State S3 bucket for distribution with the mobile app. Answer: A QUESTION: 49 A web-startup runs its very successful social news application on Amazon EC2 with an Elastic Load Balancer, an Auto-Scaling group of Java/Tomcat AWS-SAA 28http://www.examarea.comhttp://www.fravo.com application-servers, and DynamoDB as data store. The main web-application best runs on m2 x large instances since it is highly memory- bound Each new deployment requires semi-automated creation and testing of a new AMI for the application servers which takes quite a while ana is therefore only done once per week. Recently, a new chat feature has been implemented in nodejs and wails to be integrated in the architecture. First tests show that the new component is CPU bound Because the company has some experience with using Chef, they decided to streamline the deployment process and use AWS Ops Works as an application life cycle tool to simplify management of the application and reduce the deployment cycles. What configuration in AWS Ops Works is necessary to integrate the new chat module in the most cost-efficient and flexible way? A. Create one AWS Ops Works stack, create one AWS Ops Works layer, create one custom recipe B. Create one AWS Ops Works stack create two AWS Ops Works layers create one custom recipe C. Create two AWS Ops Works stacks create two AWS Ops Works layers create one custom recipe D. Create two AWS Ops Works stacks create two AWS Ops Works layers create two custom recipe Answer: C QUESTION: 50 You are implementing a URL whitelisting system for a company that wants to restrict outbound HTTP'S connections to specific domains from their EC2-hosted applications you deploy a single EC2 instance running ***** software and configure It to accept traffic from all subnets and EC2 instances in the VPC. You configure the ***** to only pass through traffic to domains that you define in its whitelist configuration You have a nightly maintenance window or 10 minutes where ail instances fetch new software updates. Each update Is about 200MB In size and there are 500 instances In the VPC that routinely fetch updates After a few days you notice that some machines are failing to successfully download some, but not all of their updates within the maintenance window. The download URLs used for these updates are correctly listed in the *****'s whitelist configuration and you are able to access them manually using a web browser on the instances. What might be happening? (Choose 2 answers) A. You are running the ***** on an undersized EC2 instance type so network throughput is not sufficient for all instances to download their updates in time. B. You have not allocated enough storage to the EC2 instance running me ***** so the network buffer is filling up. causing some requests to fall C. You are running the ***** in a public subnet but have not allocated enough EIPs lo support the needed network throughput through the Internet Gateway AWS-SAA 29http://www.examarea.comhttp://www.fravo.com (IGW) D. You are running the ***** on a affilelentiy-sized EC2 instance in a private subnet and its network throughput is being throttled by a NAT running on an undersized EO£ instance E. The route table for the subnets containing the affected EC2 instances is not configured to direct network traffic for the software update locations to the *****. Answer: B, C QUESTION: 51 Your fortune 500 company has under taken a TCO analysis evaluating the use of Amazon S3 versus acquiring more hardware The outcome was that ail employees would be granted access to use Amazon S3 for storage of their personal documents. Which of the following will you need to consider so you can set up a solution that incorporates single sign-on from your corporate AD or LDAP directory and restricts access for each user to a designated user folder in a bucket? (Choose 3 Answers) A. Setting up a federation ***** or identity provider B. Using AWS Security Token Service to generate temporary tokens C. Tagging each folder in the bucket D. Configuring IAM role E. Setting up a matching IAM user for every user in your corporate directory that needs access to a folder in the bucket Answer: A, B, C QUESTION: 52 To serve Web traffic for a popular product your chief financial officer and IT director have purchased 10 ml large heavy utilization Reserved Instances (RIs) evenly spread across two availability zones: Route 53 is used to deliver the traffic to an Elastic Load Balancer (ELB). After several months, the product grows even more popular and you need additional capacity As a result, your company purchases two C3.2xlarge medium utilization Ris You register the two c3 2xlarge instances with your ELB and quickly find that the ml large instances are at 100% of capacity and the c3 2xlarge instances have significant capacity that's unused Which option is the most cost effective and uses EC2 capacity most effectively? A. Use a separate ELB for each instance type and distribute load to ELBs with Route 53 weighted round robin B. Configure Autoscaning group and Launch Configuration with ELB to add up AWS-SAA 30http://www.examarea.comhttp://www.fravo.com to 10 more on-demand mi large instances when triggered by Cloudwatch shut off c3 2xiarge instances C. Route traffic to EC2 ml large and c3 2xlarge instances directly using Route 53 latency based routing and health checks shut off ELB D. Configure ELB with two c3 2xiarge Instances and use on-demand Autoscailng group for up to two additional c3.2xlarge instances Shut on mi .large instances. Answer: D QUESTION: 53 A web design company currently runs several FTP servers that their 250 customers use to upload and download large graphic files They wish to move this system to AWS to make it more scalable, but they wish to maintain customer privacy and Keep costs to a minimum. What AWS architecture would you recommend? A. ASK their customers to use an S3 client instead of an FTP client. Create a single S3 bucket Create an IAM user for each customer Put the IAM Users in a Group that has an IAM policy that permits access to sub-directories within the bucket via use of the 'username' Policy variable. B. Create a single S3 bucket with Reduced Redundancy Storage turned on and ask their customers to use an S3 client instead of an FTP client Create a bucket for each customer with a Bucket Policy that permits access only to that one customer. C. Create an auto-scaling group of FTP servers with a scaling policy to automatically scale- in when minimum network traffic on the auto-scaling group is below a given threshold. Load a central list of ftp users from S3 as part of the user Data startup script on each Instance. D. Create a single S3 bucket with Requester Pays turned on and ask their customers to use an S3 client instead of an FTP client Create a bucket tor each customer with a Bucket Policy that permits access only to that one customer. Answer: C QUESTION: 54 You are running a news website in the eu-west-1 region that updates every 15 minutes. The website has a world-wide audience it uses an Auto Scaling group behind an Elastic Load Balancer and an Amazon RDS database Static content resides on Amazon S3, and is distributed through Amazon CloudFront. Your Auto Scaling group is set to trigger a scale up event at 60% CPU utilization, you use an Amazon RDS extra large DB instance with 10.000 Provisioned IOPS its CPU utilization is around 80%. While freeable memory is in the 2 GB range. Web analytics reports show that the average load time of your web pages is around 1 5 to 2 seconds, but your SEO consultant wants to bring down the average load time to under 0.5 seconds. How would you improve page load times AWS-SAA 31http://www.examarea.comhttp://www.fravo.com for your users? (Choose 3 answers) A. Lower the scale up trigger of your Auto Scaling group to 30% so it scales more aggressively. B. Add an Amazon ElastiCache caching layer to your application for storing sessions and frequent DB queries C. Configure Amazon CloudFront dynamic content support to enable caching of re-usable content from your site D. Switch Amazon RDS database to the high memory extra large Instance type E. Set up a second installation in another region, and use the Amazon Route 53 latency- based routing feature to select the right region. Answer: A, B, D QUESTION: 55 You have been asked to design the storage layer for an application. The application requires disk performance of at least 100,000 IOPS in addition, the storage layer must be able to survive the loss of an individual disk. EC2 instance, or Availability Zone without any data loss. The volume you provide must have a capacity of at least 3 TB. Which of the following designs will meet these objectives'? A. Instantiate an 12 8xlarge instance in us-east-1a Create a RAID 0 volume using the four 800GB SSD ephemeral disks provided with the instance Provision 3x1 TB EBS volumes attach them to the instance and configure them as a second RAID 0 volume Configure synchronous, block-level replication from the ephemeral-backed volume to the EBS-backed volume. B. Instantiate an 12 8xlarge instance in us-east-1a create a raid 0 volume using the four 800GB SSD ephemeral disks provide with the Instance Configure synchronous block-level replication to an Identically configured Instance in useast- 1b. C. Instantiate a c3 8xlarge Instance In us-east-1 Provision an AWS Storage Gateway and configure it for 3 TB of storage and 100 000 IOPS Attach the volume to the instance. D. Instantiate a c3 8xlarge instance in us-east-i provision 4x1TB EBS volumes, attach them to the instance, and configure them as a single RAID 5 volume Ensure that EBS snapshots are performed every 15 minutes. E. Instantiate a c3 8xlarge Instance in us-east-1 Provision 3x1TB EBS volumes attach them to the instance, and configure them as a single RAID 0 volume Ensure that EBS snapshots are performed every 15 minutes. Answer: D AWS-SAA 32http://www.examarea.comhttp://www.fravo.com QUESTION: 56 You are designing a connectivity solution between on-premises infrastructure and Amazon VPC Your server’s on-premises will De communicating with your VPC instances You will De establishing IPSec tunnels over the internet You will be using VPN gateways and terminating the IPsec tunnels on AWS-supported customer gateways. Which of the following objectives would you achieve by implementing an IPSec tunnel as outlined above? (Choose 4 answers) A. End-to-end protection of data in transit B. End-to-end Identity authentication C. Data encryption across the Internet D. Protection of data in transit over the Internet E. Peer identity authentication between VPN gateway and customer gateway F. Data integrity protection across the Internet Answer: C, D, E, F QUESTION: 57 Your company plans to host a large donation website on Amazon Web Services (AWS). You anticipate a large and undetermined amount of traffic that will create many database writes. To be certain that you do not drop any writes to a database hosted on AWS. Which service should you use? A. Amazon RDS with provisioned IOPS up to the anticipated peak write throughput. B. Amazon Simple Queue Service (SOS) for capturing the writes and draining the queue to write to the database. C. Amazon ElastiCache to store the writes until the writes are committed to the database. D. Amazon DynamoDB with provisioned write throughput up to the anticipated peak write throughput. Answer: A Reference:http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html QUESTION: 58 Your team has a tomcat-based Java application you need to deploy into development, test and production environments. After some research, you opt to use Elastic Beanstalk due to its tight integration with your developer tools and RDS due to its ease of management. Your QA team lead points out that you need AWS-SAA 33http://www.examarea.comhttp://www.fravo.com to roll a sanitized set of production data into your environment on a nightly basis. Similarly, other software teams in your org want access to that same restored data via their EC2 instances in your VPC .The optimal setup for persistence and security that meets the above requirements would be the following. A. Create your RDS instance as part of your Elastic Beanstalk definition and alter its security group to allow access to it from hosts in your application subnets. B. Create your RDS instance separately and add its IP address to your application's DB connection strings in your code Alter its security group to allow access to it from hosts within your VPC's IP address block. C. Create your RDS instance separately and pass its DNS name to your app's DB connection string as an environment variable. Create a security group for client machines and add it as a valid source for DB traffic to the security group of the RDS instance itself. D. Create your RDS instance separately and pass its DNS name to your's DB connection string as an environment variable Alter its security group to allow access to It from hosts In your application subnets. Answer: A QUESTION: 59 Your firm has uploaded a large amount of aerial image data to S3 In the past, in your on- premises environment, you used a dedicated group of servers to oaten process this data and used Rabbit MQ - An open source messaging system to get job information to the servers. Once processed the data would go to tape and be shipped offsite. Your manager told you to stay with the current design, and leverage AWS archival storage and messaging services to minimize cost. Which is correct? A. Use SQS for passing job messages use Cloud Watch alarms to terminate EC2 worker instances when they become idle. Once data is processed, change the storage class of the S3 objects to Reduced Redundancy Storage. B. Setup Auto-Scaled workers triggered by queue depth that use spot instances to process messages in SOS Once data is processed, C. Change the storage class of the S3 objects to Reduced Redundancy Storage. Setup Auto-Scaled workers triggered by queue depth that use spot instances to process messages in SQS Once data is processed, change the storage class of the S3 objects to Glacier. D. Use SNS to pass job messages use Cloud Watch alarms to terminate spot worker instances when they become idle. Once data is processed, change the storage class of the S3 object to Glacier. Answer: D AWS-SAA 34http://www.examarea.comhttp://www.fravo.com QUESTION: 60 You need a persistent and durable storage to trace call activity of an IVR (Interactive Voice Response) system. Call duration is mostly in the 2-3 minutes timeframe. Each traced call can be either active or terminated. An external application needs to know each minute the list of currently active calls, which are usually a few calls/second. Put once per month there is a periodic peak up to 1000 calls/second for a few hours. The system is open 24/7 and any downtime should be avoided. Historical data is periodically archived to files. Cost saving is a priority for this project. What database implementation would better fit this scenario, keeping costs as low as possible? A. Use RDS Multi-AZ with two tables, one for -Active calls" and one for - Terminated calls". In this way the "Active calls_ table is always small and effective to access. B. Use DynamoDB with a "Calls" table and a Global Secondary Index on a "IsActive'" attribute that is present for active calls only In this way the Global Secondary index is sparse and more effective. C. Use DynamoDB with a 'Calls" table and a Global secondary index on a 'State" attribute that can equal to "active" or "terminated" in this way the Global Secondary index can be used for all Items in the table. D. Use RDS Multi-AZ with a "CALLS" table and an Indexed "STATE* field that can be equal to 'ACTIVE" or -TERMINATED" In this way the SOL query Is optimized by the use of the Index. Answer: A QUESTION: 61 A web company is looking to implement an external payment service into their highly available application deployed in a VPC Their application EC2 instances are behind a public lacing ELB Auto scaling is used to add additional instances as traffic increases under normal load the application runs 2 instances in the Auto Scaling group but at peak it can scale 3x in size. The application instances need to communicate with the payment service over the Internet which requires whitelisting of all public IP addresses used to communicate with it. A maximum of 4 whitelisting IP addresses are allowed at a time and can be added through an API. How should they architect their solution? A. Route payment requests through two NAT instances setup for High Availability and whitelist the Elastic IP addresses attached to the MAT instances. B. Whitelist the VPC Internet Gateway Public IP and route payment requests through the Internet Gateway. AWS-SAA 35http://www.examarea.comhttp://www.fravo.com C. Whitelist the ELB IP addresses and route payment requests from the Application servers through the ELB. D. Automatically assign public IP addresses to the application instances in the Auto Scaling group and run a script on boot that adds each instances public IP address to the payment validation whitelist API. Answer: B QUESTION: 62 You deployed your company website using Elastic Beanstalk and you enabled log file rotation to S3. An Elastic Map Reduce job is periodically analyzing the logs on S3 to build a usage dashboard that you share with your CIO. You recently improved overall performance of the website using Cloud Front for dynamic content delivery and your website as the origin After this architectural change, the usage dashboard shows that the traffic on your website dropped by an order of magnitude. How do you fix your usage dashboard'? A. Enable Cloud Front to deliver access logs to S3 and use them as input of the Elastic Map Reduce job. B. Turn on Cloud Trail and use trail log tiles on S3 as input of the Elastic Map Reduce job C. Change your log collection process to use Cloud Watch ELB metrics as input of the Elastic Map Reduce job D. Use Elastic Beanstalk "Rebuild Environment" option to update log delivery to the Elastic Map Reduce job. E. Use Elastic Beanstalk 'Restart App server(s)" option to update log delivery to the Elastic Map Reduce job. Answer: D QUESTION: 63 You currently operate a web application In the AWS US-East region The application runs on an auto-scaled layer of EC2 instances and an RDS Multi-AZ database Your IT security compliance officer has tasked you to develop a reliable and durable logging solution to track changes made to your EC2.IAM And RDS resources. The solution must ensure the integrity and confidentiality of your log data. Which of these solutions would you recommend? A. Create a new CloudTrail trail with one new S3 bucket to store the logs and with the global services option selected Use IAM roles S3 bucket policies and Multi Factor Authentication (MFA) Delete on the S3 bucket that stores your logs. B. Create a new CloudTrail with one new S3 bucket to store the logs Configure AWS-SAA 36http://www.examarea.comhttp://www.fravo.com SNS to send log file delivery notifications to your management system Use IAM roles and S3 bucket policies on the S3 bucket mat stores your logs. C. Create a new CloudTrail trail with an existing S3 bucket to store the logs and with the global services option selected Use S3 ACLs and Multi Factor Authentication (MFA) Delete on the S3 bucket that stores your logs. D. Create three new CloudTrail trails with three new S3 buckets to store the logs one for the AWS Management console, one for AWS SDKs and one for command line tools Use IAM roles and S3 bucket policies on the S3 buckets that store your logs. Answer: A QUESTION: 64 Your department creates regular analytics reports from your company's log files All log data is collected in Amazon S3 and processed by daily Amazon Elastic MapReduce (EMR) jobs that generate daily PDF reports and aggregated tables in CSV format for an Amazon Redshift data warehouse. Your CFO requests that you optimize the cost structure for this system. Which of the following alternatives will lower costs without compromising average performance of the system or data integrity for the raw data? A. Use reduced redundancy storage (RRS) for PDF and csv data in Amazon S3. Add Spot instances to Amazon EMR jobs Use Reserved Instances for Amazon Redshift. B. Use reduced redundancy storage (RRS) for all data in S3. Use a combination of Spot instances and Reserved Instances for Amazon EMR jobs use Reserved instances for Amazon Redshift. C. Use reduced redundancy storage (RRS) for all data in Amazon S3 Add Spot Instances to Amazon EMR jobs Use Reserved Instances for Amazon Redshitf. D. Use reduced redundancy storage (RRS) for PDF and csv data in S3 Add Spot Instances to EMR jobs Use Spot Instances for Amazon Redshift. Answer: B QUESTION: 65 A large real-estate brokerage is exploring the option o( adding a cost-effective location based alert to their existing mobile application The application backend infrastructure currently runs on AWS Users who opt in to this service will receive alerts on their mobile device regarding real-estate otters in proximity to their location. For the alerts to be relevant delivery time needs to be in the low minute count the existing mobile app has 5 million users across the us Which one of the following architectural suggestions would you make to the customer? AWS-SAA 37http://www.examarea.comhttp://www.fravo.com A. The mobile application will submit its location to a web service endpoint utilizing Elastic Load Balancing and EC2 instances: DynamoDB will be used to store and retrieve relevant otters EC2 instances will communicate with mobile earners/device providers to push alerts back to mobile application. B. Use AWS DirectConnect or VPN to establish connectivity with mobile carriers EC2 instances will receive the mobile applications ' location through carrier connection: ROS will be used to store and relevant relevant offers EC2 instances will communicate with mobile carriers to push alerts back to the mobile application C. The mobile application will send device location using SQS. EC2 instances will retrieve the relevant others from DynamoDB AWS Mobile Push will be used to send offers to the mobile application D. The mobile application will send device location using AWS Mobile Push EC2 instances will retrieve the relevant offers from DynamoDB EC2 instances will communicate with mobile carriers/device providers to push alerts back to the mobile application. Answer: A QUESTION: 66 Your customer is willing to consolidate their log streams (access logs application logs security logs etc.) in one single system. Once consolidated, the customer wants to analyze these logs in real time based on heuristics. From time to time, the customer needs to validate heuristics, which requires going back to data samples extracted from the last 12 hours? What is the best approach to meet your customer’s requirements? A. Send all the log events to Amazon SQS. Setup an Auto Scaling group of EC2 servers to consume the logs and apply the heuristics. B. Send all the log events to Amazon Kinesis develop a client process to apply heuristics on the logs C. Configure Amazon Cloud Trail to receive custom logs, use EMR to apply heuristics the logs D. Setup an Auto Scaling group of EC2 syslogd servers, store the logs on S3 use EMR to apply heuristics on the logs Answer: C QUESTION: 67 Your startup wants to implement an order fulfillment process for selling a personalized gadget that needs an average of 3-4 days to produce with some orders taking up to 6 months you expect 10 orders per day on your first day. 1000 orders per day after 6 months and 10,000 orders after 12 months. Orders coming in are checked for consistency men dispatched to your manufacturing plant for AWS-SAA 38http://www.examarea.comhttp://www.fravo.com production quality control packaging shipment and payment processing If the product does not meet the quality standards at any stage of the process employees may force the process to repeat a step Customers are notified via email about order status and any critical issues with their orders such as payment failure. Your case architecture includes AWS Elastic Beanstalk for your website with an RDS MySQL instance for customer data and orders. How can you implement the order fulfillment process while making sure that the emails are delivered reliably? A. Add a business process management application to your Elastic Beanstalk app servers and re-use the ROS database for tracking order status use one of the Elastic Beanstalk instances to send emails to customers. B. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 Use the decider instance to send emails to customers. C. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 use SES to send emails to customers. D. Use an SQS queue to manage all process tasks Use an Auto Scaling group of EC2 Instances that poll the tasks and execute them. Use SES to send emails to customers. Answer: C QUESTION: 68 You are designing the network infrastructure for an application server in Amazon VPC Users will access all the application instances from the Internet as well as from an on- premises network The on-premises network is connected to your VPC over an AWS Direct Connect link. How would you design routing to meet the above requirements? A. Configure a single routing Table with a default route via the Internet gateway Propagate a default route via BGP on the AWS Direct Connect customer router Associate the routing table with all VPC subnets. B. Configure a single routing table with a default route via the internet gateway Propagate specific routes for the on-premises networks via BGP on the AWS Direct Connect customer router Associate the routing table with all VPC subnets. C. Configure a single routing table with two default routes: one to the internet via an Internet gateway the other to the on-premises network via the VPN gateway use this routing table across all subnets in your VPC. D. Configure two routing tables one that has a default route via the Internet gateway and another that has a default route via the VPN gateway Associate both routing tables with each VPC subnet. AWS-SAA 39http://www.examarea.comhttp://www.fravo.com Answer: A QUESTION: 69 A company is running a batch analysis every hour on their main transactional DB. running on an RDS MySQL instance to populate their central Data Warehouse running on Redshift During the execution of the batch their transactional applications are very slow When the batch completes they need to update the top management dashboard with the new data The dashboard is produced by another system running on-premises that is currently started when a manually-sent email notifies that an update is required The on-premises system cannot be modified because is managed by another team. How would you optimize this scenario to solve performance issues and automate the process as much as possible? A. Replace RDS with Redshift for the batch analysis and SNS to notify the onpremises system to update the dashboard B. Replace ROS with Redsnift for the oaten analysis and SQS to send a message to the on-premises system to update the dashboard C. Create an RDS Read Replica for the batch analysis and SNS to notify me onpremises system to update the dashboard D. Create an RDS Read Replica for the batch analysis and SQS to send a message to the on-premises system to update the dashboard. Answer: D QUESTION: 70 Your application is using an ELB in front of an Auto Scaling group of web/application servers deployed across two AZs and a Multi-AZ RDS Instance for data persistence. The database CPU is often above 80% usage and 90% of I/O operations on the database are reads. To improve performance you recently added a single-node Memcached ElastiCache Cluster to cache frequent DB query results. In the next weeks the overall workload is expected to grow by 30%. Do you need to change anything in the architecture to maintain the high availability or the application with the anticipated additional load'* Why? A. Yes. you should deploy two Memcached ElastiCache Clusters in different AZs because the ROS Instance will not Be able to handle the load It me cache node fails. B. No. if the cache node fails the automated ElastiCache node recovery feature will prevent any availability impact. C. Yes you should deploy the Memcached ElastiCache Cluster with two nodes in the same AZ as the RDS DB master instance to handle the load if one cache node fails. D. No if the cache node fails you can always get the same data from the DB AWS-SAA 40http://www.examarea.comhttp://www.fravo.com without having any availability impact. Answer: B QUESTION: 71 A 3-tier e-commerce web application is current deployed on-premises and will be migrated to AWS for greater scalability and elasticity The web server currently shares read-only data using a network distributed file system The app server tier uses a clustering mechanism for discovery and shared session state that depends on IP multicast The database tier uses shared-storage clustering to provide database fall over capability, and uses several read slaves for scaling Data on all servers and the distributed file system directory is backed up weekly to off-site tapes Which AWS storage and database architecture meets the requirements of the application? A. Web servers, store read-only data in S3, and copy from S3 to root volume at boot time App servers snare state using a combination or DynamoDB and IP unicast Database use RDS with multi-AZ deployment and one or more Read Replicas Backup web and app servers backed up weekly via Mils database backed up via DB snapshots. B. Web servers store -read-only data in S3, and copy from S3 to root volume at boot time App servers share state using a combination of DynamoDB and IP unicast Database, use RDS with multi-AZ deployment and one or more read replicas Backup web servers app servers, and database backed up weekly to Glacier using snapshots. C. Web servers store read-only data In S3 and copy from S3 to root volume at boot time App servers share state using a combination of DynamoDB and IP unicast Database use RDS with multi-AZ deployment Backup web and app servers backed up weekly via AM is. Database backed up via DB snapshots D. Web servers, store read-only data in an EC2 NFS server, mount to each web server at boot time App servers share state using a combination of DynamoDB and IP multicast Database use RDS with multi-AZ deployment and one or more Read Replicas Backup web and app servers backed up weekly via Mils database backed up via DB snapshots Answer: B QUESTION: 72 Your company hosts a social media site supporting users in multiple countries. You have been asked to provide a highly available design tor the application that leverages multiple regions tor the most recently accessed content and latency sensitive portions of the wet) site The most latency sensitive component of the application involves reading user preferences to support web site personalization AWS-SAA 41http://www.examarea.comhttp://www.fravo.com and ad selection. In addition to running your application in multiple regions, which option will support this application’s requirements? A. Serve user content from S3. CloudFront and use Route53 latency-based routing between ELBs in each region Retrieve user preferences from a local DynamoDB table in each region and leverage SQS to capture changes to user preferences with SOS workers for propagating updates to each table. B. Use the S3 Copy API to copy recently accessed content to multiple regions and serve user content from S3. CloudFront with dynamic content and an ELB in each region Retrieve user preferences from an ElasticCache cluster in each region and leverage SNS notifications to propagate user preference changes to a worker node in each region. C. Use the S3 Copy API to copy recently accessed content to multiple regions and serve user content from S3 CloudFront and Route53 latency-based routing Between ELBs In each region Retrieve user preferences from a DynamoDB table and leverage SQS to capture changes to user preferences with SOS workers for propagating DynamoDB updates. D. Serve user content from S3. CloudFront with dynamic content, and an ELB in each region Retrieve user preferences from an ElastiCache cluster in each region and leverage Simple Workflow (SWF) to manage the propagation of user preferences from a centralized OB to each ElastiCache cluster. Answer: A QUESTION: 73 You are running a successful multitier web application on AWS and your marketing department has asked you to add a reporting tier to the application. The reporting tier will aggregate and publish status reports every 30 minutes from user-generated information that is being stored in your web application s database. You are currently running a Multi- AZ RDS MySQL instance for the database tier. You also have implemented Elasticache as a database caching layer between the application tier and database tier. Please select the answer that will allow you to successfully implement the reporting tier with as little impact as possible to your database. A. Continually send transaction logs from your master database to an S3 bucket and generate the reports off the S3 bucket using S3 byte range requests. B. Generate the reports by querying the synchronously replicated standby RDS MySQL instance maintained through Multi-AZ. C. Launch a RDS Read Replica connected to your Multi AZ master database and generate reports by querying the Read Replica. D. Generate the reports by querying the ElastiCache database caching tier. AWS-SAA 42http://www.examarea.comhttp://www.fravo.com Answer: A QUESTION: 74 You are developing a new mobile application and are considering storing user preferences in AWS.2w This would provide a more uniform cross-device experience to users using multiple mobile devices to access the application. The preference data for each user is estimated to be 50KB in size Additionally 5 million customers are expected to use the application on a regular basis. The solution needs to be cost-effective, highly available, scalable and secure, how would you design a solution to meet the above requirements? A. Setup an RDS MySQL instance in 2 availability zones to store the user preference data. Deploy a public facing application on a server in front of the database to manage security and access credentials B. Setup a DynamoDB table with an item for each user having the necessary attributes to hold the user preferences. The mobile application will query the user preferences directly from the DynamoDB table. Utilize STS. Web Identity Federation, and DynamoDB Fine Grained Access Control to authenticate and authorize access. C. Setup an RDS MySQL instance with multiple read replicas in 2 availability zones to store the user preference data .The mobile application will query the user preferences from the read replicas. Leverage the MySQL user management and access privilege system to manage security and access credentials. D. Store the user preference data in S3 Setup a DynamoDB table with an item for each user and an item attribute pointing to the user’ S3 object. The mobile application will retrieve the S3 URL from DynamoDB and then access the S3 object directly utilize STS, Web identity Federation, and S3 ACLs to authenticate and authorize access. Answer: B QUESTION: 75 A web company is looking to implement an intrusion detection and prevention system into their deployed VPC. This platform should have the ability to scale to thousands of instances running inside of the VPC. How should they architect their solution to achieve these goals? A. Configure an instance with monitoring software and the elastic network interface (ENI) set to promiscuous mode packet sniffing to see an traffic across the VPC. B. Create a second VPC and route all traffic from the primary application VPC through the second VPC where the scalable virtualized IDS/IPS platform resides. C. Configure servers running in the VPC using the host-based 'route' commands AWS-SAA 43http://www.examarea.comhttp://www.fravo.com to send all traffic through the platform to a scalable virtualized IDS/IPS. D. Configure each host with an agent that collects all network traffic and sends that traffic to the IDS/IPS platform for inspection. Answer: C QUESTION: 76 You are designing an SSUTLS solution that requires HTTPS clients to be authenticated by the Web server using client certificate authentication. The solution must be resilient. Which of the following options would you consider for configuring the web server infrastructure? (Choose 2 answers) A. Configure ELB with TCP listeners on TCP/4d3. And place the Web servers behind it. B. Configure your Web servers with EIPS Place the Web servers in a Route53 Record Set and configure health checks against all Web servers. C. Configure ELB with HTTPS listeners, and place the Web servers behind it. D. Configure your web servers as the origins for a CloudFront distribution. Use custom SSL certificates on your CloudFront distribution. Answer: A, B QUESTION: 77 You are designing a multi-platform web application for AWS The application will run on EC2 instances and will be accessed from PCs. tablets and smart phones Supported accessing platforms are Windows. MACOS. IOS and Android Separate sticky session and SSL certificate setups are required for different platform types which of the following describes the most cost effective and performance efficient architecture setup? A. Setup a hybrid architecture to handle session state and SSL certificates onprem and separate EC2 Instance groups running web applications for different platform types running in a VPC. B. Set up one ELB for all platforms to distribute load among multiple instance under it Each EC2 instance implements ail functionality for a particular platform. C. Set up two ELBs The first ELB handles SSL certificates for all platforms and the second ELB handles session stickiness for all platforms for each ELB run separate EC2 instance groups to handle the web application for each platform. D. Assign multiple ELBS to an EC2 instance or group of EC2 instances running the common components of the web application, one ELB for each platform type Session stickiness and SSL termination are done at the ELBs. AWS-SAA 44http://www.examarea.comhttp://www.fravo.com Answer: D QUESTION: 78 You have launched an EC2 instance with four (4) 500 GB EBS Provisioned IOPS volumes attached The EC2 Instance Is EBS-Optimized and supports 500 Mbps throughput between EC2 and EBS The two EBS volumes are configured as a single RAID o device, and each Provisioned IOPS volume is provisioned with 4.000 IOPS (4 000 16KB reads or writes) for a total of 16.000 random IOPS on the instance The EC2 Instance initially delivers the expected 16 000 IOPS random read and write performance Sometime later in order to increase the total random I/O performance of the instance, you add an additional two 500 GB EBS Provisioned IOPS volumes to the RAID Each volume Is provisioned to 4.000 IOPs like the original four for a total of 24.000 IOPS on the EC2 instance Monitoring shows that the EC2 instance CPU utilization increased from 50% to 70%. but the total random IOPS measured at the instance level does not increase at all. What is the problem and a valid solution? A. Larger storage volumes support higher Provisioned IOPS rates: increase the provisioned volume storage of each of the 6 EBS volumes to 1TB. B. The EBS-Optimized throughput limits the total IOPS that can be utilized use an EBS- Optimized instance that provides larger throughput. C. Small block sizes cause performance degradation, limiting the I'O throughput, configure the instance device driver and file system to use 64KB blocks to increase throughput. D. RAID 0 only scales linearly to about 4 devices, use RAID 0 with 4 EBS Provisioned IOPS volumes but increase each Provisioned IOPS EBS volume to 6.000 IOPS. E. The standard EBS instance root volume limits the total IOPS rate, change the instant root volume to also be a 500GB 4.000 Provisioned IOPS volume. Answer: E QUESTION: 79 You've been hired to enhance the overall security posture for a very large ecommerce site They have a well architected multi-tier application running in a VPC that uses ELBs in front of both the web and the app tier with static assets served directly from S3 They are using a combination of RDS and DynamoOB for their dynamic data and then archiving nightly into S3 for further processing with EMR They are concerned because they found questionable log entries and suspect someone is attempting to gain unauthorized access. Which approach provides a cost effective scalable mitigation to this kind of attack? A. Recommend mat they lease space at a DirectConnect partner location and AWS-SAA 45http://www.examarea.comhttp://www.fravo.com establish a 1G DirectConnect connection to theirvPC they would then establish Internet connectivity into their space, filter the traffic in hardware Web Application Firewall (WAF). And then pass the traffic through the DirectConnect connection into their application running in their VPC. B. Add previously identified hostile source IPs as an explicit INBOUND DENY NACL to the web tier subnet. C. Add a WAF tier by creating a new ELB and an AutoScalmg group of EC2 Instances running a host-based WAF They would redirect Route 53 to resolve to the new WAF tier ELB The WAF tier would thier pass the traffic to the current web tier The web tier Security Groups would be updated to only allow traffic from the WAF tier Security Group D. Remove all but TLS 1 2 from the web tier ELB and enable Advanced Protocol Filtering This will enable the ELB itself to perform WAF functionality. Answer: C QUESTION: 80 Your company runs a customer facing event registration site This site is built with a 3-tier architecture with web and application tier servers and a MySQL database The application requires 6 web tier servers and 6 application tier servers for normal operation, but can run on a minimum of 65% server capacity and a single MySQL database. When deploying this application in a region with three availability zones (AZs) which architecture provides high availability? A. A web tier deployed across 2 AZs with 3 EC2 (Elastic Compute Cloud) instances in each AZ inside an Auto Scaling Group behind an ELB (elastic load balancer), and an application tier deployed across 2 AZs with 3 EC2 instances in each AZ inside an Auto Scaling Group behind an ELB. and one RDS (Relational Database Service) instance deployed with read replicas in the other AZ. B. A web tier deployed across 3 AZs with 2 EC2 (Elastic Compute Cloud) instances in each A2 inside an Auto Scaling Group behind an ELB (elastic load balancer) and an application tier deployed across 3 AZs with 2 EC2 instances in each AZ inside an Auto Scaling Group behind an ELB and one RDS (Relational Database Service) Instance deployed with read replicas in the two other AZs. C. d A web tier deployed across 2 AZs with 3 EC2 (Elastic Compute Cloud) instances in each AZ inside an Auto Scaling Group behind an ELB (elastic load balancer) and an application tier deployed across 2 AZs with 3 EC2 instances m each AZ inside an Auto Scaling Group behind an ELS and a Multi-AZ RDS (Relational Database Service) deployment. D. A web tier deployed across 3 AZs with 2 EC2 (Elastic Compute Cloud) instances in each AZ Inside an Auto Scaling Group behind an ELB (elastic load balancer). And an application tier deployed across 3 AZs with 2 EC2 instances In each AZ inside an Auto Scaling Group behind an ELB. And a Multi-AZ RDS (Relational Database services) deployment. Answer: D AWS-SAA 46http://www.examarea.comhttp://www.fravo.com QUESTION: 81 True or False: When using IAM to control access to your RDS resources, the key names that can be used are case sensitive. For example, aws:CurrentTime is NOT equivalent to AWS:currenttime. A. TRUE B. FALSE Answer: A QUESTION: 82 Groups can't___________ A. be nested more than 3 levels B. be nested at all C. be nested more than 4 levels D. be nested more than 2 levels Answer: B QUESTION: 83 What is the Reduced Redundancy option in Amazon S3? A. Less redundancy for a lower cost. B. It doesn't exist in Amazon S3, but in Amazon EBS. C. It allows you to destroy any copy of your files outside a specific jurisdiction. D. It doesn't exist at all Answer: A QUESTION: 84 Can Amazon S3 uploads resume on failure or do they need to restart? A. Restart from beginning B. You can resume them, if you flag the "resume on failure" option before uploading. AWS-SAA 47http://www.examarea.comhttp://www.fravo.com C. Resume on failure D. Depends on the file size Answer: C QUESTION: 85 Out of the stripping options available for the EBS volumes, which one has the following disadvantage : 'Doubles the amount of I/O required from the instance to EBS compared to RAID 0, because you're mirroring all writes to a pair of volumes, limiting how much you can stripe.' ? A. Raid 0 B. RAID 1+0 (RAID 10) C. Raid 1 D. Raid Answer: B QUESTION: 86 Can we attach an EBS volume to more than one EC2 instance at the same time? A. No B. Yes. C. Only EC2-optimized EBS volumes. D. Only in read mode. Answer: A QUESTION: 87 Which Amazon Storage behaves like raw, unformatted, external block devices that you can attach to your instances? A. None of these. B. Amazon Instance Storage C. Amazon EBS D. All of these Answer: C AWS-SAA 48http://www.examarea.comhttp://www.fravo.com QUESTION: 88 All Amazon EC2 instances are assigned two IP addresses at launch, out of which one can only be reached from within the Amazon EC2 network? A. Multiple IP address B. Public IP address C. Private IP address D. Elastic IP Address Answer: C QUESTION: 89 You must increase storage size in increments of at least % A. 40 B. 20 C. 50 D. 10 Answer: D QUESTION: 90 Amazon SWF is designed to help users... A. Design graphical user interface interactions B. Manage user identification and authorization C. Store Web content D. Coordinate synchronous and asynchronous tasks which are distributed and fault tolerant. Answer: D QUESTION: 91 EBS Snapshots occur _________ A. Asynchronously AWS-SAA 49http://www.examarea.comhttp://www.fravo.com B. Synchronously C. Weekly Answer: A QUESTION: 92 Read Replicas require a transactional storage engine and are only supported for the __________ storage engine A. OracleISAM B. MSSQLDB C. InnoDB D. MyISAM Answer: C QUESTION: 93 If I want an instance to have a public IP address, which IP address should I use? A. Elastic IP Address B. Class B IP Address C. Class A IP Address D. Dynamic IP Address Answer: A QUESTION: 94 What is the minimum charge for the data transferred between Amazon RDS and Amazon EC2 Instances in the same Availability Zone? A. USD 0.10 per GB B. No charge. It is free. C. USD 0.02 per GB D. USD 0.01 per GB Answer: B AWS-SAA 50http://www.examarea.comhttp://www.fravo.com QUESTION: 95 What will be the status of the snapshot until the snapshot is complete. A. running B. working C. progressing D. pending Answer: D QUESTION: 96 In the Launch Db Instance Wizard, where can I select the backup and maintenance options? A. Under DB INSTANCE DETAILS B. Under REVIEW C. Under MANAGEMENT OPTIONS D. Under ENGINE SELECTION Answer: C QUESTION: 97 What does the following command do with respect to the Amazon EC2 security groups? ec2-create-group CreateSecurityGroup A. Groups the user created security groups in to a new group for easy access. B. Creates a new security group for use with your account. C. Creates a new group inside the security group. D. Creates a new rule inside the security group. Answer: B QUESTION: 98 Provisioned IOPS Costs: you are charged for the IOPS and storage whether or not you use them in a given month. A. FALSE B. TRUE AWS-SAA 51http://www.examarea.comhttp://www.fravo.com Answer: B QUESTION: 99 Will my standby RDS instance be in the same Availability Zone as my primary? A. Only for Oracle RDS types B. Yes C. Only if configured at launch D. No Answer: D QUESTION: 100 Which service enables AWS customers to manage users and permissions in AWS? A. AWS Access Control Service (ACS) B. AWS Identity and Access Management (IAM) C. AWS Identity Manager (AIM) Answer: B QUESTION: 101 A/An acts as a firewall that controls the traffic allowed to reach one or more instances. A. security group B. ACL C. IAM D. Private IP Addresses Answer: A QUESTION: 102 To view information about an Amazon EBS volume, open the Amazon EC2 console at https://console.aws.amazon.com/ec2/, click in the Navigation pane. AWS-SAA 52http://www.examarea.comhttp://www.fravo.com A. EBS B. Describe C. Details D. Volumes Answer: D QUESTION: 103 What are the initial settings of an user created security group? A. Allow all inbound traffic and Allow no outbound traffic B. Allow no inbound traffic and Allow no outbound traffic C. Allow no inbound traffic and Allow all outbound traffic D. Allow all inbound traffic and Allow all outbound traffic Answer: C QUESTION: 104 While creating an Amazon RDS DB, your first task is to set up a DB that controls what IP addresses or EC2 instances have access to your DB Instance. A. Security Pool B. Secure Zone C. Security Token Pool D. Security Group Answer: D QUESTION: 105 Fill in the blanks: Resources that are created in AWS are identified by a unique identifier called an A. Amazon Resource Number B. Amazon Resource Nametag C. Amazon Resource Name D. Amazon Reesource Namespace AWS-SAA 53http://www.examarea.comhttp://www.fravo.com Answer: C QUESTION: 106 Amazon RDS automated backups and DB Snapshots are currently supported for only the___________ storage engine A. InnoDB B. MyISAM Answer: A QUESTION: 107 What is Amazon Glacier? A. You mean Amazon "Iceberg": it's a low-cost storage service. B. A security tool that allows to "freeze" an EBS volume and perform computer forensics on it. C. A low-cost storage service that provides secure and durable storage for data archiving and backup. D. It's a security tool that allows to "freeze" an EC2 instance and perform computer forensics on it. Answer: C QUESTION: 108 Fill in the blanks: The base URI for all requests for instance metadata is A. http://254.169.169.254/latest/ B. http://169.169.254.254/latest/ C. http://127.0.0.1/latest/ D. http://169.254.169.254/latest/ Answer: D QUESTION: 109 What does a "Domain" refer to in Amazon SWF? A. A security group in which only tasks inside can communicate with each other AWS-SAA 54http://www.examarea.comhttp://www.fravo.com B. A special type of worker C. A collection of related Workflows D. The DNS record for the Amazon SWF service Answer: C QUESTION: 110 Before I delete an EBS volume, what can I do if I want to recreate the volume later? A. Create a copy of the EBS volume (not a snapshot) B. Store a snapshot of the volume C. Download the content to an EC2 instance D. Back up the data in to a physical disk Answer: B QUESTION: 111 Using Amazon CloudWatch's Free Tier, what is the frequency of metric updates which you receive? A. 5 minutes B. 500 milliseconds. C. 30 seconds D. 1 minute Answer: A QUESTION: 112 Typically, you want your application to check whether a request generated an error before you spend any time processing results. The easiest way to find out if an error occurred is to look for an_______ node in the response from the Amazon RDS API. A. Incorrect B. Error C. FALSE AWS-SAA 55http://www.examarea.comhttp://www.fravo.com Answer: B QUESTION: 113 What does the AWS Storage Gateway provide? A. It allows to integrate on-premises IT environments with Cloud Storage. B. A direct encrypted connection to Amazon S3. C. It's a backup solution that provides an on-premises Cloud storage. D. It provides an encrypted SSL endpoint for backups in the Cloud. Answer: A QUESTION: 114 While launching an RDS DB instance, on which page I can select the Availability Zone? A. REVIEW B. DB INSTANCE DETAILS C. MANAGEMENT OPTIONS D. ADDITIONAL CONFIGURATION Answer: D QUESTION: 115 What does specifying the mapping /dev/sdc=none when launching an instance do? A. Prevents /dev/sdc from creating the instance. B. Prevents /dev/sdc from deleting the instance. C. Set the value of /dev/sdc to 'zero'. D. Prevents /dev/sdc from attaching to the instance. Answer: D QUESTION: 116 What is the durability of S3 RRS? AWS-SAA 56http://www.examarea.comhttp://www.fravo.com A. 99.99% B. 99.95% C. 99.995% D. 99.999999999% Answer: A QUESTION: 117 What does Amazon SWF stand for? A. Simple Web Flow B. Simple Work Flow C. Simple Wireless Forms D. Simple Web Form Answer: B QUESTION: 118 What is the maximum key length of a tag? A. 512 Unicode characters B. 64 Unicode characters C. 256 Unicode characters D. 128 Unicode characters Answer: D QUESTION: 119 While performing the volume status checks, if the status is insufficient-data, what does it mean? A. the checks may still be in progress on the volume B. the check has passed C. the check has failed Answer: A QUESTION: 120 What is Oracle SQL Developer? AWS-SAA 57http://www.examarea.comhttp://www.fravo.com A. An AWS developer who is an expert in Amazon RDS using both the Oracle and SQL Server DB engines B. A graphical Java tool distributed without cost by Oracle. C. It is a variant of the SQL Server Management Studio designed by Microsoft to support Oracle DBMS functionalities D. A different DBMS released by Microsoft free of cost Answer: B QUESTION: 121 True or False: When you perform a restore operation to a point in time or from a DB Snapshot, a new DB Instance is created with a new endpoint. A. FALSE B. TRUE Answer: B QUESTION: 122 Fill in the blanks:____ let you categorize your EC2 resources in different ways, for example, by purpose, owner, or environment. A. wildcards B. pointers C. Tags D. special filters Answer: C QUESTION: 123 Is creating a Read Replica of another Read Replica supported? A. Only in certain regions B. Only with MSSQL based RDS C. Only for Oracle RDS types D. No Answer: D AWS-SAA 58http://www.examarea.comhttp://www.fravo.com QUESTION: 124 What happens to the data on an instance if the instance reboots (intentionally or unintentionally)? A. Data will be lost B. Data persists C. Data may persist however cannot be sure Answer: B QUESTION: 125 Does Amazon RDS allow direct host access via Telnet, Secure Shell (SSH), or Windows Remote Desktop Connection? A. Yes B. No C. Depends on if it is in VPC or not Answer: B QUESTION: 126 SQL Server store logins and passwords in the master database. A. can be configured to but by default does not B. doesn't C. does Answer: C QUESTION: 127 Is there a limit to how many groups a user can be in? A. Yes for all users B. Yes for all users except root C. No D. Yes unless special permission granted AWS-SAA 59http://www.examarea.comhttp://www.fravo.com Answer: A QUESTION: 128 IAM provides several policy templates you can use to automatically assign permissions to the groups you create. The policy template gives the Admins group permission to access all account resources, except your AWS account information A. Read Only Access B. Power User Access C. AWS Cloud Formation Read Only Access D. Administrator Access Answer: D QUESTION: 129 Disabling automated backups disable the point-in-time recovery. A. if configured to can B. will never C. will Answer: C QUESTION: 130 When should I choose Provisioned IOPS over Standard RDS storage? A. If you have batch-oriented workloads B. If you use production online transaction processing (OLTP) workloads. C. If you have workloads that are not sensitive to consistent performance Answer: B QUESTION: 131 What does RRS stand for when talking about S3? AWS-SAA 60http://www.examarea.comhttp://www.fravo.com A. Redundancy Removal System B. Relational Rights Storage C. Regional Rights Standard D. Reduced Redundancy Storage Answer: D QUESTION: 132 What does Amazon S3 stand for? A. Simple Storage Solution. B. Storage Storage Storage (triple redundancy Storage). C. Storage Server Solution. D. Simple Storage Service. Answer: D QUESTION: 133 Can I move a Reserved Instance from one Region to another? A. No B. Only if they are moving into GovCloud C. Yes D. Only if they are moving to US East from another region Answer: A QUESTION: 134 Is Federated Storage Engine currently supported by Amazon RDS for MySQL? A. Only for Oracle RDS instances B. No C. Yes D. Only in VPC Answer: B AWS-SAA 61http://www.examarea.comhttp://www.fravo.com QUESTION: 135 What is the maximum write throughput I can provision for a single Dynamic DB table? A. 1,000 write capacity units B. 100,000 write capacity units C. Dynamic DB is designed to scale without limits, but if you go beyond 10,000 you have to contact AWS first. D. 10,000 write capacity units Answer: C QUESTION: 136 What does the following command do with respect to the Amazon EC2 security groups? ec2-revoke RevokeSecurityGroupIngress A. Removes one or more security groups from a rule. B. Removes one or more security groups from an Amazon EC2 instance. C. Removes one or more rules from a security group. D. Removes a security group from our account. Answer: C QUESTION: 137 How many types of block devices does Amazon EC2 support A A. 2 B. 3 C. 4 D. 1 Answer: A QUESTION: 138 How can I change the security group membership for interfaces owned by other AWS, such as Elastic Load Balancing? A. By using the service specific console or API\CLI commands AWS-SAA 62http://www.examarea.comhttp://www.fravo.com B. None of these C. Using Amazon EC2 API/CLI D. using all these methods Answer: A QUESTION: 139 While signing in REST/ Query requests, for additional security, you should transmit your requests using Secure Sockets Layer (SSL) by using ___________ A. HTTP B. Internet Protocol Security(IPsec) C. TLS (Transport Layer Security) D. HTTPS Answer: D QUESTION: 140 Can a 'user' be associated with multiple AWS accounts? A. No B. Yes Answer: A QUESTION: 141 IAM's Policy Evaluation Logic always starts with a default for every request, except for those that use the AWS account's root security credentials b A. Permit B. Deny C. Cancel Answer: B QUESTION: 142 Select the most correct answer: The device name /dev/sda1 (within Amazon EC2) AWS-SAA 63http://www.examarea.comhttp://www.fravo.com is _________ A. Possible for EBS volumes B. Reserved for the root device C. Recommended for EBS volumes D. Recommended for instance store volumes Answer: B QUESTION: 143 For each DB Instance class, what is the maximum size of associated storage capacity? A. 5GB B. 1TB C. 2TB D. 500GB Answer: B QUESTION: 144 What is an isolated database environment running in the cloud (Amazon RDS) called? A. DB Instance B. DB Server C. DB Unit D. DB Volume Answer: A QUESTION: 145 What are the Amazon EC2 API tools? A. They don't exist. The Amazon EC2 AMI tools, instead, are used to manage permissions. B. Command-line tools to the Amazon EC2 web service. C. They are a set of graphical tools to manage EC2 instances. AWS-SAA 64http://www.examarea.comhttp://www.fravo.com D. They don't exist. The Amazon API tools are a client interface to Amazon Web Services. Answer: B QUESTION: 146 Changes to the backup window take effect . A. from the next billing cycle B. after 30 minutes C. immediately D. after 24 hours Answer: C QUESTION: 147 In the 'Detailed' monitoring data available for your Amazon EBS volumes, Provisioned IOPS volumes automatically send______ minute metrics to Amazon CloudWatch. A. 3 B. 1 C. 5 D. 2 Answer: B QUESTION: 148 While creating the snapshots using the API, which Action should I be using? A. MakeSnapShot B. FreshSnapshot C. DeploySnapshot D. CreateSnapshot Answer: D AWS-SAA 65http://www.examarea.comhttp://www.fravo.com QUESTION: 149 Every user you create in the IAM system starts with . A. Partial permissions B. Full permissions C. No permissions Answer: C QUESTION: 150 What does Amazon EC2 provide? A. Virtual servers in the Cloud. B. A platform to run code (Java, PHP, Python), paying on an hourly basis. C. Computer Clusters in the Cloud. D. Physical servers, remotely managed by the customer. Answer: A QUESTION: 151 Will my standby RDS instance be in the same Region as my primary? A. Only for Oracle RDS types B. Yes C. Only if configured at launch D. No Answer: B QUESTION: 152 While creating the snapshots using the command line tools, which command should I be using? A. ec2-deploy-snapshot B. ec2-fresh-snapshot C. ec2-create-snapshot D. ec2-new-snapshot AWS-SAA 66http://www.examarea.comhttp://www.fravo.com Answer: C QUESTION: 153 True or False: Automated backups are enabled by default for a new DB Instance. A. TRUE B. FALSE Answer: A QUESTION: 154 What are the two types of licensing options available for using Amazon RDS for Oracle? A. BYOL and Enterprise License B. BYOL and License Included C. Enterprise License and License Included D. Role based License and License Included Answer: B QUESTION: 155 When running my DB Instance as a Multi-AZ deployment, can I use the standby for read or write operations? A. Yes B. Only with MSSQL based RDS C. Only for Oracle RDS instances D. No Answer: D QUESTION: 156 In the Amazon cloudwatch, which metric should I be checking to ensure that your DB Instance has enough free storage space? AWS-SAA 67http://www.examarea.comhttp://www.fravo.com A. FreeStorage B. FreeStorageSpace C. FreeStorageVolume D. FreeDBStorageSpace Answer: B QUESTION: 157 How many relational database engines does RDS currently support? A. Three: MySQL, Oracle and Microsoft SQL Server. B. Just two: MySQL and Oracle. C. Five: MySQL, PostgreSQL, MongoDB, Cassandra and SQLite. D. Just one: MySQL. Answer: A QUESTION: 158 Which of the following cannot be used in Amazon EC2 to control who has access to specific Amazon EC2 instances? A. Security Groups B. IAM System C. SSH keys D. Windows passwords Answer: B QUESTION: 159 By default, when an EBS volume is attached to a Windows instance, it may show up as any drive letter on the instance. You can change the settings of the Service to set the drive letters of the EBS volumes per your specifications. A. EBSConfig Service B. AMIConfig Service C. Ec2Config Service D. Ec2-AMIConfig Service AWS-SAA 68http://www.examarea.comhttp://www.fravo.com Answer: C QUESTION: 160 Amazon RDS DB snapshots and automated backups are stored in A. Amazon S3 B. Amazon ECS Volume C. Amazon RDS D. Amazon EMR Answer: A QUESTION: 161 If I write the below command, what does it do? ec2-run ami-e3a5408a -n 20 -g appserver A. Start twenty instances as members of appserver group. B. Creates 20 rules in the security group named appserver C. Terminate twenty instances as members of appserver group. D. Start 20 security groups Answer: A QUESTION: 162 Which is the default region in AWS? A. eu-west-1 B. us-east-1 C. us-east-2 D. ap-southeast-1 Answer: B QUESTION: 163 If I modify a DB Instance or the DB parameter group associated with the instance, should I reboot the instance for the changes to take effect? AWS-SAA 69http://www.examarea.comhttp://www.fravo.com A. No B. Yes Answer: B QUESTION: 164 True or False: Manually created DB Snapshots are deleted after the DB Instance is deleted. A. TRUE B. FALSE Answer: A QUESTION: 165 What are the two permission types used by AWS? A. Resource-based and Product-based B. Product-based and Service-based C. Service-based D. User-based and Resource-based Answer: D QUESTION: 166 Using Amazon IAM, can I give permission based on organizational groups? A. Yes but only in certain cases B. No C. Yes always Answer: C QUESTION: 167 Are Reserved Instances available for Multi-AZ Deployments? AWS-SAA 70http://www.examarea.comhttp://www.fravo.com A. Only for Cluster Compute instances B. Yes for all instance types C. Only for M3 instance types D. No Answer: B QUESTION: 168 By default, EBS volumes that are created and attached to an instance at launch are deleted when that instance is terminated. You can modify this behavior by changing the value of the flagto false when you launch the instance A. DeleteOnTermination B. RemoveOnDeletion C. RemoveOnTermination D. TerminateOnDeletion Answer: A QUESTION: 169 Can you create IAM security credentials for existing users? A. Yes, existing users can have security credentials associated with their account. B. No, IAM requires that all users who have credentials set up are not existing users C. No, security credentials are created within GROUPS, and then users are associated to GROUPS at a later time. D. Yes, but only IAM credentials, not ordinary security credentials. Answer: A QUESTION: 170 When you view the block device mapping for your instance, you can see only the EBS volumes, not the instance store volumes. A. Depends on the instance type B. FALSE C. Depends on whether you use API call D. TRUE AWS-SAA 71http://www.examarea.comhttp://www.fravo.com Answer: D QUESTION: 171 You must assign each server to at least________ security group A. 3 B. 2 C. 4 D. 1 Answer: D QUESTION: 172 When you run a DB Instance as a Multi-AZ deployment, the "__________ " serves database writes and reads A. secondary B. backup C. stand by D. primary Answer: D QUESTION: 173 What does Amazon Elastic Beanstalk provide? A. A scalable storage appliance on top of Amazon Web Services. B. An application container on top of Amazon Web Services. C. A service by this name doesn't exist. D. A scalable cluster of EC2 instances. Answer: B QUESTION: 174 Can I control if and when MySQL based RDS Instance is upgraded to new supported versions? AWS-SAA 72http://www.examarea.comhttp://www.fravo.com A. No B. Only in VPC C. Yes Answer: C QUESTION: 175 What happens to the I/O operations while you take a database snapshot? A. I/O operations to the database are suspended for a few minutes while the backup is in progress. B. I/O operations to the database are sent to a Replica (if available) for a few minutes while the backup is in progress. C. I/O operations will be functioning normally D. I/O operations to the database are suspended for an hour while the backup is in progress Answer: A QUESTION: 176 Which AWS instance address has the following characteristics? :"If you stop an instance, its Elastic IP address is unmapped, and you must remap it when you restart the instance." A. Both A and B B. None of these C. VPC Addresses D. EC2 Addresses Answer: A QUESTION: 177 The one-time payment for Reserved Instances is_________ refundable if the reservation is cancelled. A. always B. in some circumstances C. never AWS-SAA 73http://www.examarea.comhttp://www.fravo.com Answer: C QUESTION: 178 If I scale the storage capacity provisioned to my DB Instance by mid of a billing month, how will I be charged? A. You will be charged for the highest storage capacity you have used B. On a proration basis C. You will be charged for the lowest storage capacity you have used Answer: B QUESTION: 179 Because of the extensibility limitations of striped storage attached to Windows Server, Amazon RDS does not currently support increasing storage on a DB Instance. A. SQL Server B. MySQL C. Oracle Answer: A QUESTION: 180 Is there a method in the IAM system to allow or deny access to a specific instance? A. Only for VPC based instances B. Yes C. No Answer: C QUESTION: 181 Which features can be used to restrict access to data in S3? Choose 2 answers AWS-SAA 74http://www.examarea.comhttp://www.fravo.com A. Set an S3 ACL on the bucket or the object. B. Create a CloudFront distribution for the bucket. C. Set an S3 bucket policy. D. Enable IAM Identity Federation E. Use S3 Virtual Hosting Answer: C, D Reference:http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/privatecontent- restricting-access-to-s3.html QUESTION: 182 __________ embodies the "share-nothing" architecture and essentially involves breaking a large database into several smaller databases. Common ways to split a database include 1) splitting tables that are not joined in the same query onto different hosts or 2) duplicating a table across multiple hosts and then using a hashing algorithm to determine which host receives a given update. A. Sharding B. Failure recovery C. Federation D. DDL operations Answer: A QUESTION: 183 What does Amazon Elastic Beanstalk provide? A. An application container on top of Amazon Web Services. B. A scalable storage appliance on top of Amazon Web Services. C. A scalable cluster of EC2 instances. D. A service by this name doesn't exist. Answer: A QUESTION: 184 What does Amazon RDS stand for? AWS-SAA 75http://www.examarea.comhttp://www.fravo.com A. Regional Data Server. B. Relational Database Service. C. Nothing. D. Regional Database Service. Answer: B QUESTION: 185 After an Amazon VPC instance is launched, can I change the VPC security groups it belongs to? A. Only if the tag "VPC_Change_Group" is true B. Yes. You can. C. No. You cannot. D. Only if the tag "VPC Change Group" is true Answer: B QUESTION: 186 How can the domain's zone apex, for example, "myzoneapexdomain.com", be pointed towards an Elastic Load Balancer? A. By using an Amazon Route 53 Alias record B. By using an AAAA record C. By using an Amazon Route 53 CNAME record D. By using an A record Answer: A QUESTION: 187 Does Amazon RDS for SQL Server currently support importing data into the msdb database? A. No B. Yes Answer: A AWS-SAA 76http://www.examarea.comhttp://www.fravo.com QUESTION: 188 Please select the Amazon EC2 resource which cannot be tagged. A. images (AMIs, kernels, RAM disks) B. Amazon EBS volumes C. Elastic IP addresses D. VPCs Answer: C QUESTION: 189 If your DB instance runs out of storage space or file system resources, its status will change to and your DB Instance will no longer be available. A. storage-overflow B. storage-full C. storage-exceed D. storage-overage Answer: B QUESTION: 190 Are you able to integrate a multi-factor token service with the AWS Platform? A. Yes, using the AWS multi-factor token devices to authenticate users on the AWS platform. B. No, you cannot integrate multi-factor token devices with the AWS platform. C. Yes, you can integrate private multi-factor token devices to authenticate users to the AWS platform. Answer: A QUESTION: 191 Multi-AZ deployment supported for Microsoft SQL Server DB Instances. A. is not currently B. is as of 2013 C. is planned to be in 2014 AWS-SAA 77http://www.examarea.comhttp://www.fravo.com D. will never be Answer: A QUESTION: 192 You have a video transcoding application running on Amazon EC2. Each instance polls a queue to find out which video should be transcoded, and then runs a transcoding process. If this process is interrupted, the video will be transcoded by another instance based on the queuing system. You have a large backlog of videos which need to be transcoded and would like to reduce this backlog by adding more instances. You will need these instances only until the backlog is reduced. Which type of Amazon EC2 instances should you use to reduce the backlog in the most cost efficient way? A. Reserved instances B. Spot instances C. Dedicated instances D. On-demand instances Answer: B Reference:http://aws.amazon.com/ec2/purchasing-options/spot-instances/ QUESTION: 193 Select the correct set of options. These are the initial settings for the default security group: A. Allow no inbound traffic, Allow all outbound traffic and Allow instances associated with this security group to talk to each other B. Allow all inbound traffic, Allow no outbound traffic and Allow instances associated with this security group to talk to each other C. Allow no inbound traffic, Allow all outbound traffic and Does NOT allow instances associated with this security group to talk to each other D. Allow all inbound traffic, Allow all outbound traffic and Does NOT allow instances associated with this security group to talk to each other Answer: A AWS-SAA 78http://www.examarea.comhttp://www.fravo.com QUESTION: 194 Select the correct statement: A. You don't need not specify the resource identifier while stopping a resource B. You can terminate, stop, or delete a resource based solely on its tags C. You can't terminate, stop, or delete a resource based solely on its tags D. You don't need to specify the resource identifier while terminating a resource Answer: C QUESTION: 195 What happens to the I/O operations while you take a database snapshot? A. I/O operations to the database are suspended for an hour while the backup is in progress. B. I/O operations to the database are sent to a Replica (if available) for a few minutes while the backup is in progress. C. I/O operations will be functioning normally D. I/O operations to the database are suspended for a few minutes while the backup is in progress. Answer: D QUESTION: 196 What does Amazon Cloud Formation provide? A. The ability to setup Autoscaling for Amazon EC2 instances. B. None of these. C. A templated resource creation for Amazon Web Services. D. A template to map network resources for Amazon Web Services. Answer: C QUESTION: 197 Through which of the following interfaces is AWS Identity and Access Management available? A) AWS Management Console Command line interface (CLI) C) IAM Query API AWS-SAA 79http://www.examarea.comhttp://www.fravo.com D) Existing libraries A. Only through Command line interface (CLI) B. A, B and C C. A and C D. All of the above Answer: D QUESTION: 198 True or False: Without IAM, you cannot control the tasks a particular user or system can do and what AWS resources they might use. A. FALSE B. TRUE Answer: B QUESTION: 199 In the 'Detailed' monitoring data available for your Amazon EBS volumes, Provisioned IOPS volumes automatically send________ minute metrics to Amazon CloudWatch. A. 5 B. 2 C. 1 D. 3 Answer: C QUESTION: 200 What is the maximum response time for a Business level Premium Support case? A. 30 minutes B. 1 hour C. 12 hours D. 10 minutes AWS-SAA 80http://www.examarea.comhttp://www.fravo.com Answer: B AWS-SAA 81http://www.examarea.comhttp://www.fravo.com Quote Link to comment Share on other sites More sharing options...
Ruskey Posted January 25, 2017 Author Report Share Posted January 25, 2017 Which certification ba ? Quote Link to comment Share on other sites More sharing options...
.thumb.jpg.abf7d08f99d33f7507f9f0e982085cc3.jpg)
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.