Your developers want to run fully provisioned EC2 instances to support their application code deployments but prefer not to have to worry about manually configuring and launching the necessary infrastructure. Which of the following should they use?
Some of your application’s end users are complaining of delays when accessing your resources from remote geographic locations. Which of these services would be the most likely to help reduce the delays?
Which of the following is the best use-case scenario for Elastic Block Store?
You need to integrate your company’s local user access controls with some of your AWS resources. Which of the following can help you control the way your local users access your AWS services and administration console? (Choose two.)
The data consumed by the application you’re planning will require more speed and flexibility than you can get from a closely defined relational database structure. Which AWS database service should you choose?
You’ve launched an EC2 application server instance in the AWS Ireland region and you need to access it from the web. Which of the following is the correct endpoint address that you should use?
When working to set up your first AWS deployment, you keep coming across the term availability zone. What exactly is an availability zone?
As you plan your multi-tiered, multi-instance AWS application, you need a way to effectively organize your instances and configure their network connectivity and access control. Which tool will let you do that?
You want to be sure that the application you’re building using EC2 and S3 resources will be reliable enough to meet the regulatory standards required within your industry. What should you check?
Your organization’s operations team members need a way to access and administer your AWS infrastructure via your local command line or shell scripts. Which of the following tools will let them do that?
While building a large AWS-based application, your company has been facing configuration problems they can’t solve on their own. As a result, they need direct access to AWS support for both development and IT team leaders. Which support plan should you purchase?
You’ve got a complex, multi-tiered application running on local servers that you want to migrate to the cloud. Which of these tools will provide you with the specific tools you’ll need to move the application with the least risk and the least disruption?
You need to deploy multiple EC2 Linux instances that will provide your company with virtual private networks (VPNs) using software called OpenVPN. Which of the following will be the most efficient solutions? (Choose two.)
As part of your company’s long-term cloud migration strategy, you have a VMware virtual machine in your local infrastructure that you’d like to copy to your AWS account and run as an EC2 instance. Which of the following will be necessary steps? (Choose two.)
Your AWS CLI command to launch an AMI as an EC2 instance has failed, giving you an error message that includes InvalidAMIID.NotFound. What of the following is the most likely cause?
The sensitivity of the data your company works with means that the instances you run must be secured through complete physical isolation. What should you specify as you configure a new instance?
Normally, two instances running m5.large instance types can handle the traffic accessing your online e-commerce site, but you know that you will face short, unpredictable periods of high demand. Which of the following choices should you implement? (Choose two.)
Which of the following use cases would be most cost effective if run using spot market instances?
In the course of a routine infrastructure audit, your organization discovers that some of your running EC2 instances are not configured properly and must be updated. Which of the following configuration details cannot be changed on an existing EC2 instance?
For an account with multiple resources running as part of multiple projects, which of the following key/value combination examples would make for the most effective identification convention for resource tags?
Which of the following EBS options will you need to keep your data-hungry application that requires up to 20,000 IOPS happy?
Your organization needs to introduce Auto Scaling to its infrastructure and needs to generate a “golden image” AMI from an existing EBS volume. This image will need to be shared among multiple AWS accounts belonging to your organization. Which of the following steps will get you there? (Choose three.)
Which of the following are benefits of instance store volumes? (Choose two.)
According to default behavior (and AWS recommendations), which of the following IP addresses could be assigned as the private IP for an EC2 instance? (Choose two.)
You need to restrict access to your EC2 instance-based application to only certain clients and only certain targets. Which three attributes of an incoming data packet are used by a security group to determine whether it should be allowed through? (Choose three.)
How are IAM roles commonly used to ensure secure resource access in relation to EC2 instances?
You have an instance running within a private subnet that needs external network access to receive software updates and patches. Which of the following can securely provide that access from a public subnet within the same VPC? (Choose two.)
What do you have to do to securely authenticate to the GUI console of a Windows EC2 session?
Your application deployment includes multiple EC2 instances that need low-latency connections to each other. Which of the following AWS tools will allow you to locate EC2 instances closer to each other to reduce network latency?
To save configuration time and money, you want your application to run only when network events trigger it but shut down immediately after. Which of the following will do that for you?
Which of the following will allow you to quickly copy a virtual machine image from your local infrastructure to your AWS VPC?
You’ve configured an EC2 Auto Scaling group to use a launch configuration to provision and install an application on several instances. You now need to reconfigure Auto Scaling to install an additional application on new instances. Which of the following should you do?
You create an Auto Scaling group with a minimum group size of 3, a maximum group size of 10, and a desired capacity of 5. You then manually terminate two instances in the group. Which of the following will Auto Scaling do?
You’re running an application that receives a spike in traffic on the first day of every month. You want to configure Auto Scaling to add more instances before the spike begins and then add additional instances in proportion to the CPU utilization of each instance. Which of the following should you implement? (Choose all that apply.)
As part of your new data backup protocols, you need to manually take EBS snapshots of several hundred volumes. Which type of Systems Manager document enables you to do this?
You want to launch and manage a complex microservices container workload in AWS but you want to avoid as many configuration headaches as possible, You figure you’ll be fine with whatever defaults you’re offered. Which of these platforms is your best choice?
Your organization runs Linux-based EC2 instances that all require low-latency read/write access to a single set of files. Which of the following AWS services are your best choices? (Choose two.)
Your organization expects to be storing and processing large volumes of data in many small increments. When considering S3 usability, you’ll need to know whether you’ll face any practical limitations in the use of AWS account resources. Which of the following will normally be available only in limited amounts?
You have a publicly available file called filename stored in an S3 bucket named bucketname. Which of the following addresses will successfully retrieve the file using a web browser?
If you want the files stored in an S3 bucket to be accessible using a familiar directory hierarchy system, you’ll need to specify prefixes and delimiters. What are prefixes and delimiters?
Your web application relies on data objects stored in AWS S3 buckets. Compliance with industry regulations requires that those objects be encrypted and that related events be closely tracked. Which combination of tools should you use? (Choose two.)
You are engaged in a deep audit of the use of your AWS resources and you need to better understand the structure and content of your S3 server access logs. Which of the following operational details are likely to be included in S3 server access logs? (Choose three.)
You’re assessing the level of durability you’ll need to sufficiently ensure the long-terviability of a new web application you’re planning. Which of the following risks are covered by S3’s data durability guarantees? (Choose two.)
Which of the following explains the difference in durability between S3’sStandard-IA and S3 Intelligent-Tiering classes?
Which of the following is the 12-month availability guarantee for the S3 Standard-IA class?
Your application regularly writes data to an S3 bucket, but you’re worried about the potential for data corruption as a result of conflicting concurrent operations. Which of the following data operations would not be subject to concerns about eventual consistency?
You’re worried that updates to the important data you store in S3 might incorrectly overwrite existing files. What must you do to protect objects in S3 buckets from being accidentally lost?
Your S3 buckets contain many thousands of objects. Some of them could be moved to less expensive storage classes and others still require instant availability. How can you apply transitions between storage classes for only certain objects within an S3 bucket?
Which of the following classes will usually make the most sense for long-term storage when included within a sequence of life cycle rules?
Which of the following are the recommended methods for providing secure and controlled access to your buckets? (Choose two.)
In the context of an S3 bucket policy, which of the following statements describes a principal?
You don’t want to open up the contents of an S3 bucket to anyone on the Internet, but you need to share the data with specific clients. Generating and then sending them a presigned URL is a perfect solution. Assuming you didn’t explicitly set a value, how long will the presigned URL remain valid?
Which non-S3 AWS resources can improve the security and user experience of your S3-hosted static website? (Choose two.)
How long will it take to retrieve an archive from Amazon Glacier Deep Archive ?
You need a quick way to transfer very large (peta-scale) data archives to the cloud. Assuming your Internet connection isn’t up to the task, which of the following will be both (relatively) fast and cost-effective?
Your organization runs Windows-based EC2 instances that all require low-latency read/write access to a single set of files. Which of the following AWS services is your best choice?
What is the range of allowed IPv4 prefix lengths for a VPC CIDR block?
You’ve created a VPC with the CIDR 192.168.16.0/24. You want to assign a secondary CIDR to this VPC. Which CIDR can you use?
You need to create two subnets in a VPC that has a CIDR of 10.0.0.0/16. Which of the following CIDRs can you assign to one of the subnets while leaving room for an additional subnet? (Choose all that apply.)
What is the relationship between a subnet and an availability zone?
Which is true regarding an elastic network interface?
Which of the following statements is true of security groups?
How does an NACL differ from a security group?
What is an Internet gateway?
What is the destination for a default IPv4 route?
You create a new route table in a VPC but perform no other configuration on it. You then create a new subnet in the same VPC. Which route table will your new subnet be associated with?
You create a Linux instance and have AWS automatically assign a private IP address but not a public IP address. What will happen when you stop and restart the instance?
How can you assign a public IP address to a running instance that doesn’t have one?
When an instance with an automatically assigned public IP sends a packet to another instance’s EIP, what source address does the destination instance see?
Why must a NAT gateway reside in a different subnet than an instance that uses it?
Which of the following is a difference between a NAT instance and a NAT gateway?
Which VPC resource performs network address translation?
What must you do to configure a NAT instance after creating it?
Which of the following is true regarding VPC peering?
You’ve created one VPC peering connection between two VPCs. What must you do to use this connection for bidirectional instance-to-instance communication? (Choose all that apply.)
Which of the following can perform stateful traffic filtering? (Choose two.)
Which of the following connection types is always encrypted?
Which of the following allow EC2 instances in different regions to communicate using private IP addresses? (Choose three.)
Which of the following is true of a route in a transit gateway route table?
Which of the following is an example of a tightly coupled HPC workload?
In a relational database, a row may also be called what? (Choose two.)
What must every relational database table contain?
Which SQL statement would you use to retrieve data from a relational database table?
Which relational database type is optimized to handle multiple transactions per second?
How many database engines can an RDS database instance run?
Which database engines are compatible with existing MySQL databases? (Choose all that apply.)
Which storage engine should you use with MySQL, Aurora, and MariaDB for maximum compatibility with RDS?
Which database engine supports the bring-your-own-license (BYOL) model? (Choose all that apply.)
Which database instance class provides dedicated bandwidth for storage volumes?
If a MariaDB database running in RDS needs to write 200 MB of data every second, how many IOPS should you provision using io1 storage to sustain this performance?
Using general-purpose SSD storage, how much storage would you need to allocate to get 600 IOPS?
If you need to achieve 12,000 IOPS using provisioned IOPS SSD storage, how much storage should you allocate, assuming that you need only 100 GB of storage?
What type of database instance only accepts queries?
In a multi-AZ deployment using Oracle, how is data replicated?
Which of the following occurs when you restore a failed database instance from a snapshot?
Which Redshift distribution style stores all tables on all compute nodes?
Which Redshift node type can store up to 326 TB of data?
Which is true regarding a primary key in a nonrelational database? (Choose all that apply.)
In a DynamoDB table containing orders, which key would be most appropriate for storing an order date?
When creating a DynamoDB table, how many read capacity units should you provision to be able to sustain strongly consistent reads of 11 KB per second?
Which Redshift node type can provide the fastest read access?
Which DynamoDB index type allows the partition and hash key to differ from the base table?
To ensure the best performance, in which of the following situations would you choose to store data in a NoSQL database instead of a relational database?
What type of database can discover how different items are related to each other?
Which of the following is the greatest risk posed by using your AWS account root user for day-to-day operations?
You’re trying to create a custom IAM policy to more closely manage access to components in your application stack. Which of the following syntax-related statements is a correct description of IAM policies?
Which of the following will—when executed on its own—prevent an IAM user with no existing policies from launching an EC2 instance? (Choose three.)
Which of the following are important steps for securing IAM user accounts? (Choose two.)
To reduce your exposure to possible attacks, you’re auditing the active access keys associated with your account. Which of the following AWS CLI commands can tell you whether a specified access key is still being used?
You’re looking to reduce the complexity and tedium of AWS account administration. Which of the following is the greatest benefit of organizing your users into groups?
During an audit of your authentication processes, you enumerate a number of identity types and want to know which of them might fit the category of “trusted identity” and require deeper investigation. Which of these is not considered a trusted entity in the context of IAM roles?
Your company is bidding for a contract with a U.S. government agency that demands any cryptography modules used on the project be compliant with government standards. Which of the following AWS services provides virtual hardware devices for managing encryption infrastructure that’s FIPS 140-2 compliant?
Which of the following is the best tool for authenticating access to a VPC-based Microsoft SharePoint farm?
What is the function of Amazon Cognito identity pools?
An employee with access to the root user on your AWS account has just left your company. Since you can’t be 100 percent sure that the former employee won’t try to harm your company, which of the following steps should you take? (Choose three.)
You need to create a custom IAM policy to give one of your developers limited access to your DynamoDB resources. Which of the following elements will not play any role in crafting an IAM policy?
Which of the following are necessary steps for creating an IAM role? (Choose two.)
Which of the following uses authentication based on AWS Security Token Service (STS) tokens?
What format must be used to write an IAM policy?
If you need to allow a user full control over EC2 instance resources, which two of the following must be included in the policy you create? (Choose two.)
What is the function of Amazon Cognito user pools?
Which of the following best describe the “managed” part of AWS Managed Microsoft AD? (Choose two.)
Which of the following steps are part of the access key rotation process? (Choose three.)
What tool will allow an Elastic Container Service task to access container images it might need that are being maintained in your account’s Elastic Container Registry?
You’ve configured CloudTrail to log all management events in all regions. Which of the following API events will CloudTrail log? (Choose all that apply.)
You’ve configured CloudTrail to log all read-only data events. Which of the following events will CloudTrail log?
Sixty days ago, you created a trail in CloudTrail to log read-only management events. Subsequently someone deleted the trail. Where can you look to find out who deleted it? No other trails are configured.
What uniquely distinguishes two CloudWatch metrics that have the same name and are in the same namespace?
Which type of monitoring sends metrics to CloudWatch every five minutes?
You update a custom CloudWatch metric with the timestamp of 15:57:08 and a value of 3. You then update the same metric with the timestamp of 15:57:37 and a value of 6. Assuming the metric is a high-resolution metric, which of the following will CloudWatch do?
How long does CloudWatch retain metrics stored at one-hour resolution?
You want to use CloudWatch to graph the exact data points of a metric for the last hour. The metric is stored at five-minute resolution. Which statistic and period should you use?
Which CloudWatch resource type stores log events?
The CloudWatch Agent on an instance has been sending application logs to a CloudWatch log stream for several months. How can you remove old log events without disrupting delivery of new log events? (Choose all that apply.)
You created a trail to log all management events in all regions and send the trail logs to CloudWatch logs. You notice that some recent management events are missing from the log stream, but others are there. What are some possible reasons for this? (Choose all that apply.)
Two days ago, you created a CloudWatch alarm to monitor the VolumeReadOps on an EBS volume. Since then, the alarm has remained in an INSUFFICIENT_DATA state. What are some possible reasons for this? (Choose all that apply.)
You want a CloudWatch alarm to change state when four consecutive evaluation periods elapse with no data. How should you configure the alarm to treat missing data?
You’ve configured an alarm to monitor a metric in the AWS/EC2 namespace. You want CloudWatch to send you a text message and reboot an instance when an alarm is breaching. Which two actions should you configure in the alarm? (Choose two.)
In a CloudWatch alarm, what does the EC2 recover action do to the monitored instance?
You learn that an instance in the us-west-1 region was deleted at some point in the past. To find out who deleted the instance and when, which of the following must be true?
Which of the following may be included in an AWS Config delivery channel? (Choose all that apply.)
You configured AWS Config to monitor all your resources in the us-east-1 region. After making several changes to the AWS resources in this region, you decided you want to delete the old configuration items. How can you accomplish this?
Which of the following metric math expressions can CloudWatch graph? (Choose all that apply.)
You’ve configured an AWS Config rule to check whether CloudTrail is enabled. What could prevent AWS Config from evaluating this rule?
Which of the following would you use to execute a Lambda function whenever an EC2 instance is launched?
Which of the following describes the function of a name server?
Your organization is planning a new website and you’re putting together all the pieces of information you’ll need to complete the project. Which of the following describes a domain?
You need to decide which kind of website name will best represent its purpose. Part of that task will involve choosing a top-level domain (TLD). Which of the following is an example of a TLD?
Which of the following is the name of a record type— as used—in a zone file?
Which of the following DNS record types should you use to associate a domain name with an IP address?
Which of the following are services provided by Amazon Route 53? (Choose three.)
For regulatory compliance, your application may only provide data to requests coming from the United States. Which of the following routing policies can be configured to do this?
Your web application is hosted within multiple AWS regions. Which of the following routing policies will ensure the fastest possible access for your users?
You’re testing three versions of a new application, with each version running on its own server and the current production version on a fourth server. You want to route 15 percent of your total traffic to each of the test servers and route the remaining 85 percent of traffic to the production server. Which routing policy will you use?
You have production infrastructure in one region sitting behind one DNS domain, and for disaster recovery purposes, you have parallel infrastructure on standby in a second AWS region behind a second domain. Which routing policy will automate the switchover in the event of a failure in the production system?
Which of the following kinds of hosted zones are real options within Route 53? (Choose two.)
Which of the following actions will you need to perform to transfer a domain from an external registrar to Route 53? (Choose two.)
Which of the following actions will you need to perform to use Route 53 to manage a domain that’s being hosted on an external registrar?
Your multiserver application has been generating quality-related complaints from users and your logs show some servers are underused and others have been experiencing intermittent failures. How do Route 53 health checks test for the health of a resource so that a failover policy can direct your users appropriately?
Which of the following most accurately describes the difference between geolocation and geoproximity routing policies?
Which of the following are challenges that CloudFront is well positioned to address? (Choose two.)
Which of the following is not a permitted origin for a CloudFront distribution?
What’s the best way to control the costs your CloudFront distribution incurs?
Which of the following is not necessarily a direct benefit of using a CloudFront distribution?
Which of the following content types is the best fit for a Real-Time Messaging Protocol (RTMP) distribution?
What are valid use cases for transforming data when importing it into a data lake? (Select three.)
What AWS Data Lake transform detects duplicate data?
What’s the most efficient way to import data from an on-premises SQL database into an AWS Data Lake?
What protocols does AWS Transfer Family support? (Choose two.)
AWS Transfer Family can be used to transfer files to or from which of the following? (Choose two.)
What technology does AWS Glue use to search large data sets and perform data transformation?
What is the difference between a data lake and a data warehouse? (Choose two.)
Which of the following can AWS Data Lake import from? (Choose two.)
Which of the following can analyze data in an AWS Data Lake? (Choose two.)
Which of the following is not an appropriate use of AWS Glue?
You’re developing an application to predict future weather patterns based on RADAR images. Which of the following Kinesis services is the best choice to support this application?
You’re streaming image data to Kinesis Data Streams and need to retain the data for 30 days. How can you do this? (Choose two.)
Which of the following Kinesis services requires you to specify a destination for the stream?
You’re running an on-premises application that frequently writes to a log file. You want to stream this log file to a Kinesis Data Stream. How can you accomplish this with the least effort?
When deciding whether to use SQS or Kinesis Data Streams to ingest data, which of the following should you take into account?
You want to send streaming log data into Amazon Redshift. Which of the following services should you use? (Choose two.)
Which of the following is not an appropriate use case for Kinesis?
You need to push 2 MB per second through a Kinesis Data Stream. How many shards do you need to configure?
Multiple consumers are receiving a Kinesis Data Stream at a total rate of 3 MB per second. You plan to add more consumers and need the stream to support reads of at least 5 MB per second. How many shards do you need to add?
Which of the following does Kinesis Data Firehose not support?
What’s the minimum level of availability you need to stay under 30 minutes of downtime per month?
Your application runs on two EC2 instances in one availability zone. An elastic load balancer distributes user traffic evenly across the healthy instances. The application on each instance connects to a single RDS database instance. Assuming each EC2 instance has an availability of 90 percent and the RDS instance has an availability of 95 percent, what is the total application availability?
Your organization is designing a new application to run on AWS. The developers have asked you to recommend a database that will perform well in all regions. Which database should you recommend for maximum availability?
Which of the following can help you increase the availability of a web application? (Choose all that apply.)
You’ve configured an EC2 Auto Scaling group to use a launch configuration to provision and install an application on several instances. You now need to reconfigure Auto Scaling to install an additional application on new instances. Which of the following should you do?
You create an Auto Scaling group with a minimum group size of 3, a maximum group size of 10, and a desired capacity of 5. You then manually terminate two instances in the group. Which of the following will Auto Scaling do?
Which of the following can Auto Scaling use for instance health checks? (Choose all that apply.)
You’re running an application that receives a spike in traffic on the first day of every month. You want to configure Auto Scaling to add more instances before the spike begins and then add additional instances in proportion to the CPU utilization of each instance. Which of the following should you implement? (Choose all that apply.)
Which of the following provide the most protection against data corruption and accidental deletion for existing objects stored in S3? (Choose two.)
You need to maintain three days of backups for binary files stored across several EC2 instances in a spot fleet. What’s the best way to achieve this?
You plan to run multi-AZ RDS across three availability zones in a region. You want to have two read replicas per zone. Which database engine should you choose?
You’re running an RDS instance in one availability zone. What should you implement to be able to achieve a recovery point objective (RPO) of five minutes?
When creating subnets in a VPC, what are two reasons to leave sufficient space in the VPC for more subnets later? (Choose two.)
You plan to deploy 50 EC2 instances, each with two private IP addresses. To put all of these instances in a single subnet, which subnet CIDRs could you use? (Choose all that apply.)
You’re currently connecting to your AWS resources using a 10 Gbps Internet connection at your office. You also have end users around the world who access the same AWS resources. What are two reasons you may consider using Direct Connect in addition to your Internet connection? (Choose two.)
Before connecting a VPC to your datacenter, what must you do to ensure proper connectivity?
You plan to run a stand-alone Linux application on AWS and need 99 percent availability. The application doesn’t require a database, and only a few users will access it. You will occasionally need to terminate and re-create the instance using a different AMI. Which of the following should you use? (Choose all that apply.)
You need eight instances running simultaneously in a single region. Assuming three availability zones are available, what’s the minimum number of instances you must run in each zone to be able to withstand a single zone failure?
If your application is down for 45 minutes a year, what is its approximate availability?
You’re running an application in two regions and using multi-AZ RDS with read replicas in both regions. Users normally access the application in only one region by browsing to a public domain name that resolves to an elastic load balancer. If that region fails, which of the following should you do to fail over to the other region? (Choose all that apply.)
When a consumer grabs a message from an SQS queue, what happens to the message? (Choose two.)
What is the default visibility timeout for an SQS queue?
What is the default retention period for an SQS queue?
You want to make sure that only specific messages placed in an SQS queue are not available for consumption for 10 minutes. Which of the following settings can you use to achieve this?
Which of the following SQS queue types can handle over 50,000 in-flight messages?
What SQS queue type always delivers messages in the order they were received?
You have an application that uses long polling to retrieve messages from an SQS queue. Occasionally, the application crashes because of duplicate messages. Which of the following might resolve the issue?
A producer application places messages in an SQS queue, and consumer applications poll the queue every 5 seconds using the default polling method. Occasionally, when a consumer polls the queue, SQS reports there are no messages in the queue, even though there are. When the consumer subsequently polls the queue, SQS delivers the messages. Which of the following may explain the missing messages?
Which of the following situations calls for a dead-letter queue?
A message that’s 6 days old is sent to a dead-letter queue. The retention period for the dead-letter queue and the source queue is 10 days. What will happen to the message?
Which of the following are parameters used to describe the performance of specific EC2 instance types? (Choose three.)
As the popularity of your EC2-based application grows, you need to improve your infrastructure so that it can better handle fluctuations in demand. Which of the following are normally necessary components for successful Auto Scaling? (Choose three.)
Which of the following best describes the role that launch configurations play in Auto Scaling?
You’re considering building your new e-commerce application using a microservices architecture where individual servers are tasked with separate but complementary tasks (document server, database, cache, etc.). Which of the following is probably the best platform?
Your EC2 deployment profile would benefit from a traditional RAID configuration for the EBS volumes you’re using. Where are RAID-optimized EBS volume configurations performed?
Which of the following tools will provide both low-latency access and resilience for your S3-based data?
Which of the following tools uses CloudFront edge locations to speed up data transfers?
Your multi-tiered application has been experiencing slower than normal data reads and writes. As you work on improving performance, which of the following is not a major design consideration for a managed RDS database?
Which of the following are possible advantages of hosting a relational database on an EC2 instance over using the RDS service? (Choose two.)
You’ve received complaints from users that performance on your EC2-based graphics processing application is slower than normal. Demand has been rising over the past month or two, which could be a factor. Which of the following is the most likely to help? (Choose two.)
Which of the following load balancer types is optimized for TCP-based applications and preserves the source IP address?
Which of the following can be used to configure a CloudFormation template? (Choose three.)
Which of the following details is not a necessary component of a CloudFormation configuration?
Which of the following can be integrated into your AWS workflow through AWS OpsWorks? (Choose two.)
Which of the following are important elements of a successful resource monitoring protocol? (Choose two.)
Which of the following will most enhance the value of the CloudWatch data your resources generate? (Choose two.)
Which of the following can be used to audit the changes made to your account and resource configurations?
Which of the following caching engines can be integrated with Amazon ElastiCache? (Choose two.)
Which of the following use case scenarios are a good fit for caching using Redis and ElastiCache? (Choose two.)
Which of the following database engines is not a candidate for read replicas within Amazon RDS?
When using CloudFormation to provision multiple stacks of related resources, by which of the following should you organize your resources into different stacks? (Choose two.)
Which of the following resource properties are good candidates for definition as parameters in a CloudFormation template? (Choose two.)
You want to use nested stacks to create an EC2 Auto Scaling group and the supporting VPC infrastructure. These stacks do not need to pass any information to stacks outside of the nested stack hierarchy. Which of the following must you add to the template that creates the Auto Scaling group?
You need to update a stack that has a stack policy applied. What must you do to verify the specific resources CloudFormation will change before updating the stack?
Which of the following options can you not set in a password policy? (Choose two.)
An IAM user is attached to a customer-managed policy granting them sufficient access to carry out their duties. You want to require multifactor authentication (MFA) for this user to use the AWS CLI. What element should you change in the policy?
You created an IAM policy that another administrator subsequently modified. You need to restore the policy to its original state but don’t remember how it was configured. What should you do to restore the policy? (Choose two.)
An IAM user with full access to all EC2 actions in all regions assumes a role that has access to only the EC2 RunInstances operation in the us-east-1 region. What will the user be able to do under the assumed role?
Several objects in a S3 bucket are encrypted using a KMS customer master key. Which of the following will give an IAM user permission to decrypt these objects?
You run a public-facing application on EC2 instances. The application is backed by a database running on RDS. Users access it using multiple domain names that are hosted in Route 53. You want to get an idea of what IP addresses are accessing your application. Which of the following would you stream to CloudWatch Logs to get this information?
You’re running a web server that keeps a detailed log of web requests. You want to determine which IP address has made the most requests in the last 24 hours. What should you do to accomplish this? (Choose two.)
An application running on an EC2 instance has been updated to send large amounts of data to a server in your datacenter for backup. Previously, the instance generated very little traffic. Which GuardDuty finding type is this likely to trigger?
You’ve set up an AWS Config managed rule to check whether a particular security group is attached to every instance in a VPC. You receive an SNS notification that an instance is out of compliance. But when you check the instance a few hours later, the security group is attached. Which of the following may help explain the apparent discrepancy? (Choose two.)
You want to use Amazon Inspector to analyze the security posture of your EC2 instances running Windows. Which rules package should you not use in your assessment?
You have a distributed application running in datacenters around the world. The application connects to a public Simple Queue Service (SQS) endpoint to send messages to a queue. How can you prevent an attacker from using this endpoint to gain unauthorized access to the queue? (Choose two.)
You’re using a public-facing application load balancer to forward traffic to EC2 instances in an Auto Scaling group. What can you do to ensure users on the Internet can reach the load balancer over HTTPS without reaching your instances directly? (Choose two.)
You’re running a UDP-based application on an EC2 instance. How can you protect it against a DDoS attack?
You’re running a web application on six EC2 instances behind a network load balancer. The web application uses a MySQL database. How can you protect your application against SQL injection attacks? (Choose two.)
Which services protect against an HTTP flood attack?
Your security policy requires that you use a KMS key for encrypting S3 objects. It further requires this key be rotated once a year and revoked when misuse is detected. Which key type should you use? (Choose two.)
A developer is designing an application to run on AWS and has asked for your input in deciding whether to use a SQL database or DynamoDB for storing highly transactional application data. Your security policy requires all application data to be encrypted and encryption keys to be rotated every 90 days. Which AWS service should you recommend for storing application data? (Choose two.)
You need to copy the data from an unencrypted EBS volume to another region and encrypt it. How can you accomplish this? (Choose two.)
An instance with an unencrypted EBS volume has an unencrypted EFS filesystem mounted on it. You need to encrypt the data on an existing EFS filesystem using a KMS key. How can you accomplish this?
On which of the following can you not use an ACM-generated TLS certificate? (Choose two.)
Which of the following assesses the security posture of your AWS resources against AWS best practices?
Which of the following best describes the AWS Free Tier?
Which of the following storage classes provides the least expensive storage and transfer rates?
Which AWS service is best suited to controlling your spending by sending email alerts?
Your AWS infrastructure is growing and you’re beginning to have trouble keeping track of what you’re spending. Which AWS service is best suited to analyzing account usage data at scale?
Your company wants to more closely coordinate the administration of its multiple AWS accounts, and AWS Organizations can help it do that. How does that change your security profile? (Choose three.)
Which of the following resource states are monitored by AWS Trusted Advisor? (Choose two.)
You’re planning a new AWS deployment, and your team is debating whether they’ll be better off using an RDS database or one run on an EC2 instance. Which of the following tools will be most helpful?
Which of the following is not a metric you can configure an AWS budget to track?
Which of the following statements are true of cost allocation tags? (Choose two.)
Your online web store normally requires three EC2 instances to handle traffic but experiences a twofold increase in traffic for the two summer months. Which of the following approaches makes the most sense?
Which of the following settings do you not need to provide when configuring a reserved instance?
Your new web application requires multiple EC2 instances running 24/7 and you’re going to purchase reserved instances. Which of the following payment options is the most expensive when configuring a reserve instance?
Which of the following benefits of containers such as Docker can significantly reduce your AWS compute costs? (Choose two.)
Which of the following is the best use of an EC2 reserved instance?
Which of the following describes “unused EC2 instances matching a particular set of launch specifications”?
Which of the following best describes a spot instance interruption?
Which of the following describes the maximum instances or vCPUs you want running?
You need to make sure your EBS volumes are regularly backed up, but you’re afraid you’ll forget to remove older snapshot versions, leading to expensive data bloat. What’s the best solution to this problem?
Which of these AWS CLI commands will launch a spot fleet?
Which of the following elements is not something you’d include in your spot fleet request?