Aws Certified Solutions Architect Associate Flashcards ionicons-v5-c

Which of the following EC2 metrics will NOT be automatically collected by CloudWatch?

- The number of running processes on the instance- Average Memory Utilization

Your company is concerned with EBS volume backups on Amazon EC2, and wants to ensure they have proper backups so that the data is durable. What solutions could you implement (choose two)?

- Using CloudWatch Events, schedule a rule that calls the EC2 CreateSnapshot API.- Use a lifecycle policy for EBS Snapshots.

Why does stopping and starting an instance usually fix a System Status Check error?

Stopping and starting an instance causes the instance to be provisioned on different AWS hardware.

- Connections to S3 that have protected health information must use endpoints that use HTTPS.- Enable SSE on an S3 bucket to make use of AES-256 encryption.

Your CRM application running on EC2 needs to store and retrieve contract documents in an S3 bucket. How can your application get these permissions?

Create an IAM role with a suitable permissions policy, and a trust policy specifying the EC2 service.

One of your environments utilizes DynamoDB as a database. You need to ensure that it can only be accessed by a select number of people using specific IP addresses. What design changes do you suggest?

Configure a group of IAM users (for each level of access) for the people who need access. Give those groups access to the DynamoDB operations they need, but add a condition to the policy so that it has to match the specific IP address.

Which of the following is true regarding S3 Request Rate Performance?

- Amazon S3 provides at least 5,500 requests per second to retrieve data- Amazon S3 provides at least 3,500 requests per second to add data

What are the 3 storage interface options for AWS Storage Gateway?

- volume gateway- file gateway- tape gateway

Which of the following events can be logged using CloudTrail

- CLI Calls to the AWS Account- API Calls to the AWS Account- Operations on S3 Objects

How could you block a specific CIDR IP Block from connecting to an EC2 instance?

Attach a NACL to the subnet and add a DENY rule for the CIDR block to the NACL.

What steps are required to allow an EC2 instance to access the internet while being as secure as possible? Assume all security rules/ACL's and subnets are in place already. (Choose all that apply)

- Create a default route from the EC2 instance's subnet to the NAT Gateway.- Add a NAT gateway- Attach an internet gateway to the VPC.- Create a default route from the NAT gateway's subnet to the Internet Gateway.

You are designing an application with three components: an app server running on EC2, a media store running on S3, and a database running on DynamoDB. You have been asked to make sure your design allows a single AZ to fail without impacting service. Which option is correct?

S3 and DynamoDB are resilient to an AZ failure by design. Provision EC2 using a Launch Configuration and an Auto Scaling group to ensure it can cope with an AZ failure and auto-heal if needed.

How could you block a specific CIDR IP Block from connecting to an EC2 instance?

Attach a NACL to the subnet and add a DENY rule for the CIDR block to the NACL.

A custom CloudWatch metric has determined that your web application is returning a high number of 404 errors. How could you automatically create a message in your online Help Desk system for your webmaster? (Choose all that apply)

- Set an alarm for the metric that sends a notification to an SNS topic.- Create an SNS topic and subscribe the Create Ticket url for your Help Desk to the topic.

Your company is moving a legacy application from an on-premises data center to the cloud. The legacy application requires a static IP address hard-coded onto a backend service that uses a single instance. What options do you have to maximize the availability of this application?

- Associate an Elastic IP with a Network Load Balancer and target multiple instances in the AZ running the application.- Associate an Elastic IP address to an instance running the application, then enable EC2 Auto-recovery.

A medical company concerned about security compliance has asked you, a consultant, to perform an audit of their AWS environment. The company administrator provides you with the root login to the AWS account. After beginning the audit, you discover that the nurses who work for the company are all using a shared single login account called nurse_user1 to upload and download daily shift change reports from S3. After further investigation, you discover that the nurse_user1 account has full administrator privileges to EC2 and S3. When you document your findings, what security issues would you note in the report and what suggestion would you make to resolve the problem?

- There are three security issues: (1) you were given access to the root account, (2) the nurses are sharing an account, and (3) the nurses have full administrator privileges to EC2 and S3.- To resolve the security issues you would recommend the following: (1) create individual accounts for the nurses and put all of the nurse accounts into a group, (2) grant read/write permissions for the newly created group to the appropriate S3 bucket, and (3) recommend as a best practice that temporary accounts be created for consultants.

You have been asked to advise a junior colleague how to explicitly deny traffic from an EC2 instance to a specific remote internet FQDN. What advice would you give?

Implement a proxy service in the VPC, adjust route tables, and use the proxy server to deny access to the remote hostname.

What are two ways you could reduce the execution time of a Lambda Function?

- Increase the RAM allocated to it.- Optimize your code.

What can help boost performance of an HPC application that relies heavily on inter-node communication?

- Making sure all instances are using Enhanced Networking- Putting all instances in a Cluster Placement Group

Multiple directors in your company have opened AWS accounts. The Chief Security Officer has expressed a concern that accounts may be using unapproved AWS services and wants your advice. What action would you take?

Create a root account as the Master in AWS Organizations, and have each account join your organization. Then apply Service Control Policies to the child accounts.