Attempt 1 Question 1: Incorrect You have 2 Ubuntu instances located in different subnets in the same VPC. Now to your understanding these instances should be able to communicate with each other, but when you try to ping from one instance to another, you get a timeout. ‘The Route tables seem to be valid and has the entry for the Target “local for your VPC CIDR. Which of the following could be 2a valid reason for this issue. A The Instances are of the wrong AMI, hence you are not able to ping the instances, B. The Security Group has not been modified for allow the required traffic (Correct) . The Instances don't have Public IP, so that the ping commands can be routed incorrect) . The Instances dort have Elastic IP, so that the ping commands can be routed Explanation ‘The security groups need to configured to ensure that ping commands can go through. The below snapshot shows that the ICMP protocol needs to be allowed to ensure that the ping packets can be routed to the instances, You need to edit the Inbound Rules fof the Web Security Group. Option Ais invalid because the AM will not impact the ping command Option C and D are invalid because even if you have a Public IP and Elastic IP allocated to the Inctance, you need to ensure there isa route to the internet gateway and the Web Security Groups are configured accordingly. For more information on Security Groups, please visit the below URL: http://decs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.htm! ‘Question 2: | sipped What isthe best way to move an E8S volume currently attached to an EC? instance from one availabilty zone to another ? A. Detach the volume and attach to an EC2 instance in another AZ B. Greate a new volume in the other AZ and specify the current volume as the source, C. Create a snapshot of the volume and then create a volume from the snapshotin the other AZ (correct) a new volume In the AZ and do a disk copy of contents from one volume to another. Explanation Inorder for a volume to be available n another availability zone, you need to frst create a snapshot from the volume, Then in the snapshot from creating a volume from the snapshot, you can then specify the new availabilty zone accordingly. Option Ais, Gael tes cas is isc ad ses ss iss es sk is es cect ks bcc eeinvalid, because there is no way to specify a volume as a source Option D is invalid , because the Diskcopy would just be a tedious process. For more information on snapshots, please vist the below URL: hetp://docs.aws.amazon,com/AWSEC2/latest/User Gulde/EBSSnapshats html ‘Question 3: Incorrect When it comes to API credentials, what is the best practise recommended by AWS? ‘A. Create a role which has the necessary and can be assumed by the EC2 instance. (Correct) B, Use the API credentials from an EC2 instance. (incorrect) C. Use the API credentials from a bastion host D. Use the API credentials from a NAT Instance. Explanation IAM roles are designed in such a way so that your applications can securely make API requests from your instances, without requiring you to manage the security credentials that the applications use. Option 8,C and D are invalid because itis not secure to use API credentials from any EC2 instance. The API credentials can be tampered with and hence is not the ideal secure way to make AP! cals. For more information on IAM roles for EC2, please vist the below URL: heppi/idocs.aws.amazon,com/AWSEC2/latest/UserGulde/lam-roles for-amazon-ec2.html Question 4: Sipe You want to retrieve the Public IP addresses assigned to a running instance via the Instance metadata. Which of the below urs is valid for retrieving this data, A. hitp://169.254.169.254/latest/meta-data/publicipw4 (correct) B, http://254.169.294.169/latest/meta-data/public-ipyd . hrtp//254.169.254.169/meta-datallatest/publicipy D. http://169.254,169.254/meta-data/latest/publicipv4 Explanation {As per the AWS documentation, below is the right way to access the instance metadata For more information on Instance metadata, please visit the below URL: http//docs aws.amazon com/AWSEC2/latest/UserGuide/ec2-instance-metadata html‘Question 5: [Sil You are planning to use the MySQL RDS in AWS. You have a requirement to ensure that you are available to recover from 3 database crash. Which of the below is not 2 recommended practise when you want to fulfil this requirement A Ensure that automated backups are enabled for the ROS B. Ensure that you use the MyiSAM storage engine for MySQL (correct C.Ensure thatthe database does not grow too large D. Ensure that file sizes forthe RDS is well under 16 TB Explanation Visit KB Article for the best recammended practices for MySQL Far more infarmation on best practices for MySQL Storage, please visit the below URL: htap://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SestPractices.html#CHAP_BestPractices MySOLStorege ‘Question 6: /skppad Which of the following is a valid bucket name A. demo (correct) B. Example C. example D.demo, Explanation Following are the restrictions when naming buckets in S3. Bucket names must be at least 3 and no more than 63 characters long. Bucket names must he a series of one ar more labels. Adjacent labels are separated by a single period (). Bucket names can contain lowercase letters, numbers, and hyphens, Each label must start and end with a lowercase letter or a number. Bucket names must not be formatted as an IP address (eg, 192.168.5.4). When using virtual hosted-style buckets with SSL, the SSL wildcard certificate only matches buckets that do nat contain periods. To werk around this, use HTTP or write your own certificate verification logic. We recommend that you do not use periods (.") in bucket names. Option Bis invalid because it has ‘an upper case character Option Cis invalid because the bucket name cannot start with a period (). Option D's invalid because the bucket name cannot end with a period (). For more information on S3 Bucket restrictions, please visit the below URL: hetp:/idocs.aws.amazon com/AmazonS2/latest/dev/BucketRestrictions htm! ‘Question 7: SaWhich of the following is not a feature provided by RouteS3? C.Offloading content to cache locations (correct) D. Health check of resource Explanation Visit KB Article for features which are available for Route53 hence option A\8 and D are valid. Register domain names - Your website needs # name, such as example.com. Amazon Route 53 lets you register a name for your website or web application, known as a domain name. Route internet traffic to the resources for your domain - When a user opens a web browiser and enters your domain name in the address bar, Amazon Route 53 helps the Domain Name System (ONS) connect the browser with your website or web application. Check the health of your resources ~ Amazon Route 53 sends automated requests aver the internet to a resource, such as a web server, o verify that i's reachable, avallable, and functional. You also can choose to recehve notfications when @ resource becomes unavailable and choose to route internet traffic away from unhealthy resources. Option Cis basically a feature provided by the AWS Content Delivery service. For more information on RouteS3, please vst the below URL: http:/fdocs.aws.amazon.com/RouteS3/latest/DeveloperGuide/Welcome. html ‘Question 8: Sp When working with API gateways in AWS , what is the type of endpoints that are exposed AHTP BLHTTPS (correct) CJson D.XML Explanation Allof the endpoints created with the API gateway are of HTTPS. Option A is incorrect because Amazon AP Gateway does not ‘support unencrypted (HTTP) endpoints Option C and D are invalid because API gateway expose HTTPS endpoints only For more Information on API Gateways, please visit the below URL: https://aws.amazon.com/apigatewayifacs/ ‘Question 9: (Sepp Which of the following verbs are supported with the API GatewayAGE pur D.Allof the above (comet) Explanation Each resource within 3 REST AP! can support one or more of the standard HTTP methods. You define which verbs should be supported for each resource (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) and their implementation. For more information ‘on API Gateways, please visit the below URL: https:/aws.amazon.com/api-gateway/faqe! ‘Question 10: Sib Which of the following container technologies are currently supported by the AWS ECS service? Choose 2 answers. A. Kubernetes (Correct) B. Docker (Correct) C. Mesasphere nonical LXD. Explanation Currently Kubernetes and Docker are the container platform supported by EC2 Container Service. Far more information on ECS, please visit the below URL: https://aws.amazon.com/ecs/fags/ tps:/avs amazon.com/blogs/aws/amazon-elastic container: service-for-kubernetes! ‘Question 11: (gg Which of the following when used alongside with the AWS Secure Taken service can be used to provide a single sign-on ‘experience for existing users who are part of an organization using on-premise applications 8 JSONC.SAML20 (Correct) D. OAuth Explanation You can authenticate users in your organization's network, and then provide those users access to AWS without creating new ‘AWS identities for them and requiring them to sign in with a separate user name and password. This is known as the single sign €0n (S80) approach to temporary access. AWS STS supports open standards ke Security Assertion Markup Language (SAML) 20, with which you can use Microsoft AD FS ta leverage your Microsoft Active Directary. Option A and D are incorrect because these ‘are used when you want users to sign in using 2 wellknown third party identity provider such as Login with Amazon, Facebook, ‘Google. Option B Is Incorrect because this Is more of a data exchange protocol. For more information on STS, please visit the below URL: http://docs.aws.amazon.com/lAM/latest/UserGuide/id_credertials.temp.htm| ‘Question 12: /Stseed While performing status checks on your volume in AWS, you can see that the volume check has a status of “insufficient- data". What can you derive from this status check all checks have passed B.A particular check has failed only C.All checks have failed D. The check on the volume is stil in progress. (Correct) Explanation, Volume status checks enable you to better understand, track, and manage potential inconsistencies in the data on an Amazon, EBS volume. They are designed to provide you with the Information that you need to determine whether your Amazon EBS volumes are impaired, and to help you control hove 2 potentially inconsistent volume Is handled. Ifthe status is insufficlent-data, the checks may stillbe in progress on the volume. Option A is incorrect because if all checks have passed, then the status of the volume is OK. Option 8 and C are incorrect because if check fails, then the status of the volume is impaired For more information on Volume status checks, please vit the below URL: betp:/idocs.aws.amazon,com/AWSEC?2/latest/User Guide/manitoring-volume-status html ‘Question 13: Sige! Which of the following can constitute the term of a "Golden Image’C. This refers to an AMI that has been constructed from a customized Image. (correct) . This refers to.a special type of Linux AM Explanation ‘You can customize an Amazon EC2 instance and then save its configuration by creating an Amazon Machine Image (AMI). You canlaunch as many instances from the AMI as you need, and they will all include those customizations that you've made. Each time you want to change your configuration you will ned to create a new golden image, so you will need to have a versioning, ‘convention to manage your golden images aver time Because of the abave explanation , all ofthe remaining options are automatically invalid. For more information on AMI’, please visit the below URL: hetp:/Idocs.aws.amazon,com/AWSEC2/latest/User Gulde/AMIs.htm| Question 14: gee When designing a health check for your web application which is hosted behind an elastic load balancer, which of the following health checks is ideal to implement A.ATCP health check B. AUDP health check C.AHTTP health check (Correct) D.A combination of TCP and UDP health checks Explanation ‘Option B and D is invalid because UDP health checks are not possible Option A is partially valid. A simple TCP health check would not detect the scenario where the instance itself is healthy, but the web server process has crashed. Instead, you should assess whether the web server can return a HTTP 200 response for some simple request. For mare information on ELB health checks, please visit the below URL: http:/docs.aws.amazon.com/elasticloadbalancing/latest/claccic/elb-healthchecks. html ‘Question 15: [S55 Which of the following is an example of synchronous replication which occurs in the AWS service? A AWS RDS Read Replica's for MySQL, MariaDB and PostgresQ) B. AWS Mult-AZ RDS (Correct) C.Redis engine for Amazon ElastiCache replicationD_ AWS RD Read Replica’s for Or Explanation ‘Amazon RDS Mult-AZ deployments provide enhanced availablity and durability for Database (DB) Instances, making them a natural fit for production database workloads. When you provision a Mult?-AZ DB Instance, Amazon RDS automatically creates a primary DB Instance and synchronously replicates the data to a standby instance in a different Availability Zone (AZ). For more information on Mult-AZ, please visit the below URL: https://aws.amazon,com/rde/details/mult-az/ Option A is invalid because ‘Amazon RDS takes a snapshot of the source instance and creates a read-only instance from the snapshet. For MySQL, MariaDB, ‘and PostgreSQL, Amazon RDS uses those engines’ native asynchronous replication to updete the read replica whenever there Is ‘a change to the source DB Instance. Option C is invalid, because the Redls engine for Amazon ElastiCache supports replication with automatic failover, but the Redis engine's replication is asynchronous Option D is invalid because this is not supported by AWS. ‘Question 16: Sisped ‘You want to get the reason for your EC2 Instance termination from the CLL, Which of the below command: the reason. A. aws ec2 describe instances (Correct) B. aws ec2 describe-Imag: C. aws e¢2 get-console-sereenshot D. aws ec2 desc Explanation When you execute the AWS ec2 describe-instances CLI command with the Instance Id as shown below AWS ec2 describe. Instances ~instance-id instance id In the |SON response that's displayed, locate the StateReason element. An exemple Is shown below. This will help in understanding why the instance was shutdown. “StateReason": { "Message" “Client UserinitiatedShutdown: User initiated shutdown’, "Code": "Client.UserinitiatedShutdown" }, Option Bis invalid because this command describes one or mare of the images (AMIs, AKis, and ARl=) available to you Option C is invalid because retrieve a JPG-format screenshot of a running instance. This might nat help to the complete extent of understanding why the instance was terminated. Option D is invalld because this command describes the status of the specified volumes. Far more information on the command, please vist the below URL: http://dacs.aws. amazon. com/cl/latest/reference/ec2/describe-instances.html ‘Question 17: (ag ‘An application is currently configured on an EC2 instance to process messages in SQS. The queue has been created with the default settings. The application is configured to just read the messages once a week. It has been noticed that net all the messages are being picked by the application. What could be the issue? not being picke ¢ application fs configured to short polling, so some messages are not being picked up. Some of the messages have surpassed the retention period defined for the queue (Correct) Explanation When you create an SQS with the default options, the message retention period is 4 days. So ifthe application is processing the messages just once a week there are chances that messages sent at the start of the week wil get deleted before it can be picked up by the application. Option and B are Invalid , because even if you use short or long poling , the application should be able to read the messages eventually. Option D is invalid because you can provide permissions at the queue level. For more information on 5Q5, please visit the below URL: https://aws.amazon.com/sas/faqs! ‘Question 18; sipped Your application is on an EC2 instance in AWS. Users use the application to upload a file to $3. The message first goes to an 'SQS queue , before its picked up by a worker process, which fetches the object and uploads it to $3. An email is then sent ‘on successful completion of the upload. You notice though that you are getting numerous emails for each request, when ideally you should be getting only one final email notification for each successful upload. Which of the below could be the possible reasons for this. The application is configured for long polling so the messages are being picked up multiple times B. The application is not deleting the messay (Correct) The application s conf ing, so some messages are not being picked up igured to short ps . The application Is not reading the message properly from the Explanation When you look at the Message lifecycle from AWS for SOS queues , one of the most important aspects to delete the messages after they have been read from the queue. Option A and C are invalid because even if you use short or long polling the application should be able to read the messages eventually. The main partis that the deletion of messages is not happening, after they have been read. Option D is invalid because ifthe mescages are not heing read properly, then the application chould not send successful notifications. For more information on $QS message lifecycle, please visit the below URL: httpr/idocs.sws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-message-ifecycie:html (Question 19: (gg ‘You have created your own VPC and subnet in AWS. You have launched an instance in that subnet. You have noticed that, the instance is not receiving a DNS name. Which of the below options could be a valid reason for this issue. {AThe CIDR block for the VPC fs invalid i NeC. The VPC configuration needs to be changed (Correct) et configuration n tobe change Explanation IF the DNS hostnames option of the VPC is not set to Yes' then the instances launched in the subnet will not get ONS Names. You ‘can change the option by choosing your VPC and clicking on Edit ONS Hostnames’ Option & and B are invalid because ifthe CIDR blocks were invalid then the VPC or subnet would not be created. Option D is invalid because the subnet configuration does not have the effect on the DNS hostnames. For more information on VPCs, please visit the below URL: hetps://aws.amazon.com/vpc! ‘Question 20: sigs ‘You have created your own VPC and subnet in AWS. You have launched an instance in that subnet. You have attached an internet gateway to the VPC and seen that the instance has a public IP. The Route table is 10.0.0.0/16, The instance still ‘cannot be reached from the Internet. Which of the below changes need to be made to the route table to ensure that the issue can be resolved. A. Add the following entry to the route table ~ 0.0.0.0/0-Internet Gateway (correct) B. Modify th ute table ~ 10.0.0.0/16 Internet Gateway Add the following entry to the route table - 10.0.0.0/16 Internet Gateway . Add the following entry to the route table -0.0.0.0/16->Internet Gateway Explanation The Route table need to be to 0.0.0.0/0 to ensure that the routes from the internet can reach the instance Hence by default al ‘other options become invalid For more information on Route Tables, please visit the below URL: http://docs.sws.amazon.com/AmazonVPCilatest/UserGuide/VPC Route Tables:ntm! ‘Question 21: (ss You wanted to have a VPC created in AWS which will host an application. The application will just consist of web and database servers. The application just requires to be accessed from the internet by internet users. Which of the following VPC configuration wizards options would you use B. VPC with Public and Private Subnets (cometand Hardware VPN Acce th Public and P ‘and Hardware VPN Ace: D.VPC with a Private Subnet Only Explanation ‘The configuration for this scenario includes a virtual private cloud (VPQ) with a public subnet and a private subnet. We recommend this scenario if you want to run a public‘facing web application, while maintaining back-end servers that aren't publicly accessible. A common example is a mutt-tler website, with the web servers In a public subnet and the database servers In private subnet. You can set up security and routing so that the web servers can communicate with the database servers Option Ais invalid, because ideally you need a private subnet to host the database server. Option C and D are invalid because there is no case of accessing the application from on-premise locations using VPN connections. For more information on this scenario, please visit the below UBL: http:s/docs.aws.amazan.com/AmazonVPC/latest/UserGuide/VPC_Scenario2. htm ‘Question 22: /sispea You are a solutions architect working for a large oil and gas company. Your company runs their production environment on ‘AWS and has a custom VPC, The VPC contains 3 subnets, 1 of which is public and the other 2 are private. Inside the public subnet is a fleet of EC2 instances which are the result of an autoscaling group. All EC2 instances are in the same security ‘group. Your company has created a new custom application which connects to mobile devices using a custom port. This application has been rolled out to production and you need to open this port globally to the internet, What steps should you take to do this, and how quickly will the change occur? trol List. Your EC2 instances will be able to communicate on this A. Open the port on the port after a reboot. ting network Access C Ibe able to communicate over this B. Open the port on the « port immediately ing network Access Control List. Your EC2 instance: . Open the port on the existing security group. Your EC2 Instances willbe able to communicate over this port immediately. D. Open the port on the e as the relevant Time To Live (TTL) expires. ing secutlty group. Your EC?2 instances will be able to communicate over this port Explanation ‘One can use the Security Group , change the Inbound Rules so that the traffic will be allowed on the custom port. When you make a change to the Security Groups or Network ACL's, they are applied immediately Ths is clearly given in the AWS documentation For more information on Security Groups, please refer to the below link http://docs.aws.amazon,com/AmazonVPC/latest/UserGuide/VPC_SecurtyGroups.html (Question 23: (gs ‘You are designing various CloudFormation templates, each template to be used far a different purpose. What determines the cost of using the CloudFormation templates? P. Cleiatfonma tion rises rot have a cost sell cuntB. You are charged based on the size ofthe template C. You are charged based on the time it takes to launch the template. D. thas a bas Explanation IFyou look at the AWS Documentation, this s clearly given. You only get charged for the underiying resources created using Claud Formation templates. So , because ofthe explanation all other options automatically become invalid. For more Information on Cloudformation, please visit the below URL: https://aws.amazon.com/cloudformation/feqs/ Question 24: Spee You are creating a number of EBS Volumes for your EC2 instances. You are concerned on the backups of the EBS Volumes. Which of the below is a way to backup the EBS Volumes: A. Configure Amazon Storage Gateway with EBS volumes as the data source and store the backups en premise through the storage gateway a cronjob that uses the AWS CLI to take a snapshot of production EBS volumes. Correct) C. Use a lifecycle policy to back up EBS volumes stored on Amazon $3 for durability D. Write a cronjob on the server that compresses the data and then copy itto Glacier Explanation Apoint.in-ime snapshot of an EBS volume, can be used as a baseline for new volumes or for data backup. if you make periodic snapshots of volume, the snapshots are incremental—only the blocks on the device that have changed after your last snapshot are saved in the new snapshot. Even though snapshots are saved incrementally, the snapshot deletion process is designed =o ‘that you need to retain only the most recent snapshot in order to restare the entire volume. You can create a snapshot via the CLI commend - create-snapshat Option Als Incorrect because you normally use the Storage gateway to backup your on-premise data, Option Cis incorrect because this is used for 53 storage Option D is Incorrect because compression is another maintenance task and storing it in Glacier is not an ideal option For more information on snapshots, please visit the below URL: http:r/docs.aws.amazon.com/AWSEC2/latest/User Guidefebs-creating-snapshot htm ‘Question 25: (ise What are the services from AWS helps to migrate databases to AWS easily ?Explanation AWS Database Migration Service helps you migrate databases to AWS easly and securely. The source database remains fully ‘operational during the migration, minimizing downtime to applications that rely on the database. The AWS Database Migration Service can migrate your data to and from most widely used commercial and open-source databases. For more Information on ‘aws database migration service, please vist the URL: https:/7aws.amazon.comvdms ‘Question 26: sss Your company has petabytes of data that it wants to move from their on-premise location to AWS. Which of the following. ‘can be used to fulfil this requirement? B. AWS Migratir C.AWis vPc D.AWS Snowball (Correct) Explanation Snowballs a petabyte-scale data transport solution that uses secure appliances to transfer large amounts of data into and out ‘of the AWS cloud. Using Snowball addresses common challenges with large-scale deta transfers including high network costs, long transfer times, and security concerns. Transferring data with Snowball is simple, fast, secure, and can be as litte as one-fifth the cost of high-speed Internet. For more information, please refer the below link: http:ridocs.aws.amazon,com/snowbalVlatest/ug/whatissnowball.htm!| ‘Question 27; [SiG There are multiple issues reported from an EC2 instance hence itis required to analyze the logs files. What can be used in AWS to store and analyze the log files?D. Cloudwatch Logs Explanation ‘You can use Amazon CloudWatch Logs to manitor, store, and access your log files from Amazon Elastic Compute Cloual (Amazon C2) Instances, AWS CloudTrall, and other sources. You can then retrieve the associated log data from CloudWatch Log. To ‘enable Cloudwatch logs, follow the below steps Step 1) Go te the Cloudwatch section and click on Logs Step 2) Once you create a log group, you can then configure your EC2 instance to send logs to this Log Group. For more information on Cleudwatch logs please visit the link: ttp:/docs.aws.amazon.com/AmazonCloudWatch/latest/iogs/WhatlsCloudWatchLogs.htm| ‘Question 28: sisped You are not able to connect to an EC2 instance via SSH, and you have already verified that the instance has a public IP and the Internet gateway and route tables are in place, what should you check next? ‘A. Adjust the security group to allow traffic to port 22 (Correct) the security group to allow trafficto port 3389 start the instance since there might be some Issue with the instance D. Create a new instance since there might be some issue with the instance Explanation ‘The reason why you cannot connect to the instance Is because maybe the SSH protocol has not been enabled in the security _group. Go to your EC? Security groups, click on the required secunty groups to make the changes. Go to the Inbound Tab. Ensure that the Inbound rules has a rule for SSH protocol ‘Question 29: (Sasa Your company VPC has a need to communicate with another company VPC within the seme AWS region. What can be used from AWS to interface between the two VPC? B.VPN Connection C.Direct Connect D.VPC Peering (Correct)Explanation VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IP addresses, Instances in either VPC can communicate with each other as if they are within the same nenwork. You can create a VPC peering connection between your own VPCs, or with a VPC In another AWS account within a single region The below diagram shows an example of VPC peering. Now please note that VPC 5 cannot communicate to VEC C because there is no peering between them, For more information on VPC peering, please visit the URL: http://dacs.aws. amazon com/AmazonVPC/latest/UserGuide/vpe-peering html ‘Question 30: sipped You currently have an EC2 instance hosting a web application. The number of users is expected to increase in the coming months and hence you need to add more elasticity to your setup. Which of the following methods can help add elasti your existing setup. Choose 2 answers fram the options given below A. Setup your web app on more EC? Instances and set them behind an Elastic Load balancer (correct 2. Setup an Elastic Cache infront of the EC? instance Setup your web app on more EC? instances and use RouteS3 to route requests accordingly (correct D. Setup DynamoD8 behind your EC? Instan Explanation ‘The Elastic Load balancer fs one of the mast the ideal solution for adding elastcty to your application. The below snapshot is an ‘example where you can add 3 EC2 Instances to an ELB. All requests can then be rauted accordingly to these instances. The other alternative isto create @ routing policy in RouteS3 with Weighted routing policy. Weighted resource record sets let you associate multiple resources wth a single DNS name. Weighted routing policy enables Route 53 to route trafic to different resources in specified proportions (weights) To create a group of weighted resource record sets, two or more resource record sets can be ‘created that have the same combination of DNS name and type, and each resource record cet is assigned a unique identifier and 2 relative welght. Option Bis not valid because this wil ust cache the reads , and will not add that desired elasticity to your ‘application, Option D Is not vallé , because there is no mention of a persistence layer In the question , that would require the use ‘of DynamoDB. For more information on Elastic Load Balancer, please visit the below URL: https://aws.amazon.com/elasticloadbalancing/ For more information on RouteS3, please visit the below URL: http:r/docs.aws.amazor.com/RouteS3/latest/DeveloperGuide/Welcome.htm| ‘Question 31: [BBE You are creating a Provisioned 1OPS volume in AWS. The size of the volume is 8 GiB, Which of the following are the possible values that can put for the |OPS of the volumeExplanation ‘The Maximum ratio of [OPS to volume size Is 50:1, so ifthe volume size Is 8 GIB , the maximum IOPS of the volume can be 400. if you go beyond this value, you will get an error as shown in the screenshet below. For more information on Provisioned IOPS, please visit the below URL: http:/docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.htm ‘Question 32: /Stisped A company is hosting EC2 instances which focuses on workloads are on non-production and non-priority batch loads. Also these processes can be interrupted at any time. What is the best pricing model which can be used for EC2 instances in this case? B. On-Demand Instances €. Spot instances (correct) D. Regular instances Explanation ‘Spot instances enable you to bid on unused EC? Instances, which can lower your Amazon EC2 costs significantly. The hourly price for a Spot Instance (of each Instance type n each Availablity Zone) Is set by Amazon EC2, and fluctuates depending on the supply Cf and demand for Spot instances. Your Spot instance runs whenever your bid exceeds the current market price. Spot instances are a cost-effective choice if you can be flexible about when your applications run and if your applications can be interrupted. For ‘example, Spot instances are well-suited for data analysis, batch jobs, backgraund pracescing, and optional tacks Option A is invalid because even though Reserved instances can reduce costs, Its best for workloads that would be active fora longer period ‘of time rather than for batch load processes which could last for a shorter period of time. Option Bs nat right because On. Demand Instances tend to be more expensive than Spot Instances. Option D Is invalid because there Is no concept of Regular instances in AWS For more information on Spot Instances, please vist the below URL: http://docs.aws.amazon.com/AWSEC2/latest/User Guide/using-spot-instances.html ‘Question 33: [BEE ‘A photo-sharing service stores pictures in Amazon Simple Storage Service ($3) and allows application sign-in using an ‘OpeniD Connect-compatible identity provider. Which AWS Security Token Service approach to temporary access should you use for the Amazon $3 operations? A. SAML-based IdentityC.AWS Identity and Access Mana D.Web Identity Federation (correct) Explanation ‘The AWS Documentation mentions the below With web identity federation, you don’t need to create custom sigrvin code or manage your own user identities. Instead, users of your app can sign in using a well-known identity provider (IdP) such as Login with Amazon, Facebook, Google, or any other OpeniD Connect (O1DC}-compatible idP, receive an authentication token, and then exchange that token for temporary security credentials in AWS that map to an IAM role with permissions to use the resources in your AWS account. Using an Id? helps yau keep your AWS account secure, because you don't have to embed and Cistribute long-term security credentials with your application, For mare information on Web Identity Federation, please vist the belowWURL: hetpu/docs.aws.amazon.com/lAMVletest/UserGulde/id_roles. providers oldc.html ‘Question 34: sipped In Cloudtrail, where does it store all of the logs that it creates? Choose one answer from the options given below. A. A separate EC2 instance with EBS storay B.ARDS instance .ADynamoDB ins D.Amazon $3 (correct) Explanation When you enable Cloudtrail, you need to provide an S3 bucket where all the logs can be written to. For more information on AWIS Cloudtril, please visit https://aws.amazon.com/cloudtrail/ ‘Question 35: (Sige In the event of an unplanned outage of your primary DB, AWS RDS automatically switches over to the secondary. In such a ‘case which record in Route 53 is changed? Select one answer from the options given below A. DNAME B. CNAME (Correct)D.Mx Explanation ‘The AWS documentation clearly highlights what happens in the event of an automatic fallover for an AWS RDS instance, For more information on AWS RDS, please visit httpsil/aws.amazon.com/rds/faqs/ ‘Question 26: sigs Which of the below resources cannot be tagged in AWS B. EBS Volumes VPC endpoint (correct) D.vec Explanation ‘Tags enable you to categorize your AWS resources In diferent ways, for example, by purpose, owner, or environment. This Is useful when you have many resources of the same type — you can quickly identify @ specific resource based on the tags you've ‘assigned to it. Each tag consists of a key and an optional value, both of which you define, But you cannot tag a VPC endpoint For more information on AWS Resourcing Tagging, please visit betp:/idocs.aws.amazon.com/AWSEC? /latest/UserGuide/Using Tags html Question 37: Sipps What type of monitoring for EBS volumes is available automatically in 5 minute periods at no charge?’ Basic (correct) > B. Primary Detailed Explanation Visit the AWS documentation for the types of monitoring data. For more information on Volume monitoring, please visitae EE EE eee ‘Question 38: /Sisped There is a company website that is going to be launched in the coming weeks. There is a probability that the traffic will be {quite high in the first couple of weeks. In the event of a load failure, how can you set up DNS failover to a static website? Choose the correct answer from the options given below. AA Duplicate the exact application architecture in another region and configure DNS weight-based routing B. Enable falover to an on-premise data center to the application he: C. Use Route 53 with the failover aption to failover to a static 83 website bucket or CloudFront distribution. (Correct) . Add more servers in case the application fail, Explanation ‘Amazon Route 53 health checks monitor the health and performance of your web applications, web servers, and ether resources. if you have multiple resources that perform the same function, you can configure DNS fallover so that Amazon. Route 53 will route your traffic from an unhealthy resource to a healthy resource. For example, if you have two web servers and ‘one web server becomes unhealthy, Amazon Route 53 can route traffic to the other web server. So you can route traffic toa website hosted on $3 or toa cloudfront distribution. For more information on DNS fallover using RauteS3, please refer to the below link http:/idocs.aws.amazon.com/RouteS2/latest/DeveloperGuide/dns failover. html ‘Question 39: Sine! What is one of the major advantages of having a VPN in AWS? You don't have to worry about security this is managed by AWS, B. You can connect your cloud resources to on-premise data centers using VPN connections (correct) C.You can provision unlimized nu D. None af the above Explanation ‘One of the major advantages is that you can combine your on-premise data center to AWS via a VPN connection. You can create ‘an IPsec, hardware VPN connection between your VPC and your remote network. On the AWS side of the VPN connection, 2 virtual private gateway provides two VPN endpoints for automatic fallover. You configure your customer gateway, which is the physical device or software application on the remote side of the VPN connection. For more information on VEN connections, please refer to the below link http://docs.aws.amazon.com/AmazonVPC/latest/UserGuice/vpn-connections:htm‘Question 40: sip ‘One of your instances is reporting an unhealthy system status check. However, this is not something you should have to monitor and repair on your own. How might you automate the repair of the system status check failure in an AWS ‘environment? Choose the correct answer fram the options given below Create CloudWatch alarms that stop and start the instance based off of status check alarms (Correct) .C2.AP\ for each instance status check pt that Write a script that periodically shuts down and starts instances based on certain stats. D. Implement a third party m toring tool Explanation Using Amazon CloudWatch alarm actions, you can create alarms that automatically stop, terminate, reboot, or recover your EC2 instances. You can use the stop or terminate actions to help you save money when you no longer need an instance to be running, You ean use the reboot and recover actions ta automatically reboot thase instances or recover them onto new hardware ifa system impairment occurs, For more information on using alarm actions, please refer to the below link hetp://docs.aws.amazon,com/AmazonCloudWatch/latest/monitoring/UsingAlarmActions, html Question 41: Spee! A company is running three production web server reserved EC2 instances with EBS-backed root volumes. These instances have a consistent CPU load of 80%. Traffic is being distributed to these instances by an Elastic Load Balancer. They also have production and development Multi-AZ RDS MySQL databases. What recommendation would you make to reduce cost in this, environment without affecting availability of mission-critical systems? Choose the correct answer from the options given below and instances Instead instances B. Consider not using a Mult -AZRDS deployment for the development database (correct) C. Consider using spot instances instead of reserved EC? instan ng the Elastic Load Balance Explanation Mult:AZ databases Is better for production environments rather than for development environments, o you can reduce costs by not using this for development environments Amazon RDS Mukt-AZ deployments provide enhanced avallabilty and durability for Database (DB) Instances, making them a natural fit for production database workloads. When you provision @ Mult-AZ DB Instance, Amazon RDS automatically creates a primary DB Instance and synchronously replicates the data to a standby instance ina different Availability Zone (AZ). Each AZ runs on its own physically distinct, independent infrastructure, and is engineered taESD ae eRe cree eee an a eT SRO eee NT ee ERT RT ES Ree ae an mere replica in the case of Amazon Aurora), so that you can resume database operations as soon as the fallover Is complete. Since the ‘endpoint for your DB Instance remains the same after a fallover, your application can resume database operation without the need for manual administrative intervention For more information on Mult-AZ RDS, please refer to the below link https:/aws.amazon.comirds/details/mult-a2/ ‘Question 42: sipped ‘A.company has assigned two web server instances in a VPC subnet to an Elastic Load Balancer (ELB). Hoviever, the instances {and the ELB are not reachable via URL to the Elastic Load Balancer (ELB). How can you resolve the issue so that your web server instances can start serving the web app data to the public Internet? Choose the correct answer from the options given below he subnet (Correct) A Attach an Internet gateway to the VPC and route i d an elastic IP address to the instance D. None of the above Explanation If the Internet gateway is not attached to the VPC, which is a pre-requisite forthe instances to be accessed from the internet then the instances will not be reachable. You can assign instance from private subnet to ELB, in that case, ELB will automatically become internal ELE and AWS will acsign scheme as "Internal f your subnet is public then ELB will automaticaly become ‘external ELB and AWS will assign scheme as “Internet facing”. You can add Internet Gateway to VPC and add IGW route in the subnet to make It avaliable over the internet, hoviever, in that case, AWS wil still show ELB scheme as internal but twill allow Internet trafficto the Instance. See Internal load balancer detalls here: htp://dacs.aws.amazon.com/elasticloadbalancing/latest/classicfelb-create-internalloac-balancer html For more information on Internet gateways, please refer to the below link: hetp:/idocs.aws.amazon cam/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.htm| ‘Question 43: (BEE A company has EC2 instances running in AWS. The EC2 instances are running via an Autoscaling solution. There is 2 lot of. application requests or work items being lost because of the load on the servers. The Autoscaling solution is launching new instances to take the load but there are still some application requests which are being lost. Which of the Following is likely to provide the most cost-effective solution to avoid losing recently submitted requests? Choose the correct answer from the ‘options given below ‘A. Use an SQS queue to decouple the applic yn components (correct) B. Keep one extra EC2 inctance always powered on in case a spike occu . Use larger instances for your applicatiorD. Prewarm you! Explanation ‘Amazon Simple Queue Service (5Q5) sa fully-managed message queuing service for reliably communicating among distributed software components and microservices - at any scale. Building applications from individual components that each perfarm a iserete function improves scalability and reliability, and is best practice design for madern applications For more information an 'SQS, please refer to the below link https://aws.amazon.com/sqs/ Question 44: stipes You have a set of IIS Servers running on EC2 instances for a high traffic web site. You want ta collect and pracess the lg files generated from the IIS Servers. Which of the below services is ideal to run in this seenario ‘A. Amazon S3 For storing the log files and Amazon EMR for processing the log Miles (correct) 8. Amazon S3 for storing the log files and EC2 instances for processing the log files Amazon EC2 for storing and processing the logfiles . Amazon DynamaDB to store the logs and EC2 for running custom log analysis scripts Explanation, ‘Amazon EMER is @ managed cluster platform that simplifies running big data frameworks, such as Apache Hadaop and Apache ‘Spark, on AWS to process and analyze vast amounts of data. By using there frameworks and related open-source projects, such 25 Apache Hive and Apache Pig, you can process data for analytics purposes and business intelligence workloads. Additionally, you can use Amazon EMR to transform and move large amounts of data inte and out of other AWS data stores and databases, ‘such as Amazon Simple Storage Service (Amazon S3) and Amazon DynamaDB. Option B and C,, even though partially correct. ‘would be an overhead for EC? Instances to process the log files when you already have a ready made service which can help in this regard Option D isin invalid because DynamoDB is nat an ideal option to stare log files. For more information on EMR, please visit the below URL: http:/docs.aws.amazon.comJemylatest/ManagementGuide/emr-wwhat-is-emy.html ‘Question 45: [SSE You are trying to configure Cross Region Replication for your 53 bucket. But you are not able to select the option of Cross. Region Replication and is disabled. Which of the below could be the possible reasons for this ? A. The feature isnot available in that region B. You need to enable versioning on the bucket (correct) C. The source region is currently dowSE! Explanation, Requirements for cross-region replication: The source and destination buckets must be versioning-enabled. The source and destination buckets must be in different AWS regions. You can replicate objects from a source bucket to only one destination bucket. Amazon 53 must have permission te replicate objects from that source bucket to the destination bucket on your behalf. Irthe source bucket owner also owne the abject, the bucket owner has full permissions to replicate the object. If nt, the source bucket owner must have permission for the Amazon $3 actions s3:GetObjactVersion and s2:GetObjectVersionACL to read the ‘object and object ACL. If you are setting up cross-region replication in a cross-account scenario (where the source and destination buckets are owned by different AWS accounts), the source bucket owner must have permission to replicate abjects in the destination bucket. The destination bucket owner needs to grant these permissions via @ bucket policy. Option As invalid , because it s available in al regions Option C is invalid because ifso, then you would not be able to access 53 in hat region ‘ption D is invalid because you have nat reached the configuration stage to selact the destination buicket For more information ‘on S3 Cross Region Replication, please vist the below URL: https://dacs.aws amazon com/AmazonSvlatestidevlert htm! Question 46; singe 1g Lambda functions per invocation. What is the amount of temp space is allocated to you when u B.512MB (correct) D.16Gie Explanation ‘The snapshot from the AWS documentation lists some of the service limits with AWS Lambda Far more information on AWS Lambda, please visi the below URL: https/docs.aws.amazon.com/lambda/latest/dgzlimits.htm (Question 47: (gg ‘You have a requirement to create a subnet in an AWS VPC which will host around 20 hosts. This subnet will be used to host web servers, Which of the below could be the possible CIDR block allocated for the subnet, A.10.0.1.027 (correct) D.10.0.1.0/30Explanation With this configuration you can have 27 allowable hosts which fits the requirement. Option B is invalid because you can have ‘only a maxiumum of 16 hosts with this canfiguration Option C and D are invalid because you can ascign a single CIDR block toa VPC. The allowed block size Is between a /16 netmask and /28 netmask. For more information on Subnets, please visit the below URL: httpi/idocs.aws.amazon.com/AmazonVPC/latest/UserGulde/VPC_Subnets.htm| Question 48: gps ‘You run a website which hosts videos and you have twa types ef members, premium fee paying members and free members. All videos uploaded by both your premium members and free members are processed by a fleet of EC2 instances ‘which will poll SQS as videos are uploaded. However you need to ensure that your premium fee paying members videos have a higher priority than your free members. How do you design SOS? ASQ allows you to set priorities on individual items within the queue, so simply set the fee paying members ata higher priority than your free members. B. Create two SQS queues, one for premium members and one for free members. Program your EC2 fleet to poll the premium queue first and if empty, to then poll your free members SOS queue. (Correct) €. S05 would not be sultable for this scenario, It would be much better to use SNS to encode the videos. Use SNS to notiy when a premium member has uploaded a video and then process that video accordingly. Explanation Inthis case, you can have multiple SOS queues. The SOS queues for the premium members can be polled first by the EC2 Instances and then those messages can be processed. For information on SQS best practices, please refer to the below link bttp://dacs.aws. amazon com/AWSSimpleQueueService/latest/SQSDevelaperGuide/=qs-best-practices html ‘Question 49: (iBBe Ina VPC, you have launched two web servers and attached to an internet facing ELB. Both your web servers and ELB are located in the public subnet. Yet, you are still not able to access your web application via the ELB's DNS through the internet. What could be done to resolve this issue? > Attach an Internet gateway to the VPC and route itto the subnet (Correct) B. Add an elastic IP ada the insta ©. Use Amazz n Elastic Load Balancer to serve requests to your instances located in the internal subnet D. Recreate the instances againExplanation You need to ensure that the VPC has an internet gateway attached and the route table properly configured for the subnet. ‘Option B Is invalid because even the ELB Is not accessible from the internet. Option Cs invalid because the instances and ELB Is not reachable via internet if no internet gateway is attached to the VPC. Option D is invalid because this will not have an impact ‘on the issue. For more information on troubleshooting ELB, please vist the below URL: hetps://aws.amazon,com/premiumsupportsknowledge-center/elb-cannectvity troubleshoating/ ‘Question 50: sis ‘You want to ensure that you keep a check on the Active Volumes, Active snapshots and Elastic IP addresses you use so that you don't go beyond the service limit. Which of the below services can help in this regard? S Cloudwatch BL AWS EC2 C.AWS Trusted Adviso (correct) D.AWS SNS Explanation An online resource to help you reduce cost, increase performance, and improve security by optimizing your AWS environment, Trusted Advisor provides realtime guidance to help you provision your resources following AWS best practices. Below is a snapshot of the service limits it can monitor Option A is invalid because even though you can monitor resources, it cannot be ‘hacked against the cervice limit. Option B is invalid because this is the Elastic Compute cloud service Option D fs invalid because itcan be send natifcation but not check on service limits Far more information on the Trusted Advisor monitoring, please visit the below URL: https:/aws.amazon.com/premiumsupportita-faqs/ Question 51: [Sipe ‘You are building an automated transcription service in which Amazon EC2 worker instances process an uploaded audio file and generate a text file. You must store both of these files in the same durable storage until the text file is retrieved. You de not know what the storage capacity requirements are. Which storage option is both cost-efficient and scalable? A. Multiple Am solume with sna B. Asingle Amazon Glacier vault zon S3 bucket (Correct) C-Asingle am: D. Malt