Professional Practice Questions part 2

One of your work colleagues has just left and you have been handed some of the infrastructure he set up. In one of the setups you start looking at, he has created multiple components of a single application and all the components are hosted on a single EC2 instance (without an ELB) in a VPC. You have been told that this needs to be set up with two separate SSLs for each component. Which of the following would best achieve the setting up off the two separate SSLs while using still only using one EC2 instance?

Choose the correct answer:

Your job at a large scientific institution is moving along nicely. It is at the forefront of the latest research on nano-technology, of which you have become very passionate. You have been put in charge of scaling up some existing infrastructure which currently has 9 EC2 instances running in a Placement Group. All these 9 instances were initially launched at the same time and seem to be performing as expected. You decide that you need to add 2 new instances to the group; however, when you attempt to do this you receive a ‘capacity error’. Which of the following actions will most likely fix this problem?

Choose the correct answer:

You have been told by your security officer that you need to give a presentation on encryption on data at rest on AWS to 50 of your co-workers. You feel like you understand this extremely well regarding data stored on AWS S3 so you aren’t too concerned, but you begin to panic a little when you realize you also probably need to talk about encryption on data stored on your databases, namely Amazon RDS. Regarding Amazon RDS encryption, which of the following statements is the truest?

Choose the correct answer:

BCJC is consulting for a company that runs their current application entirely all on-premise. However, they are expecting a big boost in traffic tomorrow and need to figure out a way to decrease the load to handle the scale. Unfortunately, they cannot migrate their application to AWS in the period required. What could they do with their current on-premise application to help offload some of the traffic and scale to meet the demand expected in 24 hours?

Choose the correct answer:

You are designing multi-region architecture and you want to send users to a geographic location based on latency- based routing, which seems simple enough; however, you also want to use weighted-based routing among resources within that region. Which of the below setups would best accomplish this?

Choose the correct answer:

BCJC has a legacy application with licensing that is attached to a single MAC address. Since an EC2 instance can receive a new MAC address when launching new instances, how can you ensure that your EC2 instance can maintain a single MAC address for licensing?

Choose the correct answer:

You have been given a new brief from your supervisor for a client who needs a web application set up on AWS. The most important requirement is that MySQL must be used as the database, and this database must not be hosted in the public cloud, but rather at the client’s data center due to security risks. Which of the following solutions would be the best to assure that the client’s requirements are met?

Choose the correct answer:

Your company has just set up a new document server on it’s AWS VPC, and it has four very important clients that it wants to give access to. These clients also have VPCs on AWS and it is through these VPCs that they will be given accessibility to the document server. In addition, each of the clients should not have access to any of the other clients’ VPCs.

Choose the correct answer:

You’ve recently migrated an application from a customer’s on-premise data center to the AWS cloud. Currently, you’re using the ELB to serve traffic to the legacy application. The ELP is also using HTTP port 80 as the health check ping port. The application is currently responding by returning a website on port 80 when you test the IP address directly. However, the instance is not registering as healthy even though the appropriate amount of time has passed for the health check to register as healthy.

How might the issue be resolved?

Choose the correct answer:

You’ve created a mobile application that serves data stored in an Amazon DynamoDB table. Your primary concern is scalability of the application and being able to handle millions of visitors and data requests. As part of your application, the customer needs access to the data located in the DynamoDB table. Given the application requirements, what would be the best method for designing the application?

Choose the correct answer:

You have just developed a new mobile application that handles analytics workloads on large scale datasets that are stored on Amazon Redshift. Consequently, the application needs to access Amazon Redshift tables. Which of the below methods would be the best, both practically and security-wise, to access the tables?

Choose the correct answer:

Given the following IAM policy assign to user “jeff”

{
“Version”: “2012-10-17”,
“Statement”: [
{
“Action”: [
“ec2:StartInstances”,
“ec2:StopInstances”,
“ec2:RebootInstances”,
“ec2:TerminateInstances”
],
“Condition”: {
“StringEquals”: {
“ec2:ResourceTag/env”:”production”
}
},
“Resource”: [
“arn:aws:ec2:us-east-1:account-id:instance/*”

],
“Effect”: “Deny”
}
]
}

Choose the correct answer:

A new client may use your company to move all their existing Data Center applications and infrastructure to AWS. This is going to be a huge contract for your company, and you have been handed the entire contract and need to provide an initial scope to this possible new client. One of the things you notice concerning the existing infrastructure is that it has a small amount of legacy applications that you are almost certain will not work on AWS. Which of the following would be the best strategy to employ regarding the migration of these legacy applications?

Choose the correct answer:

Once again your security officer is on your case and this time is asking you to make sure the AWS Key Management Service (AWS KMS) is working as it is supposed to. You are initially not too sure how KMS even works, however after some intense late night reading you think you have come up with a reasonable definition. Which of the following best describes how the AWS Key Management Service works?

Choose the correct answer:

BCJC has a library of on-demand MP4 files needing to be streamed publicly on their new video webinar website. The video files are archived and are expected to be streamed globally, primarily on mobile devices.

Given the requirements what would be the best architecture for BCJC to design?

Choose the correct answer:

BCJC has hired a third-party security auditor, and the auditor needs read-only access to all AWS resources and logs of all VPC records and events that have occurred on AWS. How can BCJC meet the auditor’s requirements without comprising security in the AWS environment?

Choose the correct answer:

You’re working as a consultant for a company that has a three tier application. The application layer of this architecture sends over 20Gbps of data per seconds during peak hours to and from Amazon S3. Currently, you’re running two NAT gateways in two subnets to transfer the data from your private application layer to Amazon S3. You will also need to ensure that the instances receive software patches from a third party repository.

What architecture changes should be made, if any?

Choose the correct answer:

You are building a large-scale confidential documentation web server on AWS and all of the documentation for it will be stored on S3. One of the requirements is that it cannot be publicly accessible from S3 directly, and you will need to use CloudFront to accomplish this. Which of the methods listed below would satisfy the requirements as outlined?

Choose the correct answer:

You are setting up a VPN for a customer to connect his remote network to his Amazon VPC environment. There are a number of ways to accomplish this and to help you decide you have been given a list of the things that the customer has specified that the network needs to be able to do. They are as follows:

– Predictable network performance
– Support for BGP peering and routing policies
– A secure IPsec VPN connection but not over the Internet

Which of the following VPN options would best satisfy the customer’s requirements?

Choose the correct answer:

Your company has just purchased some very expensive software which also involved the addition of a unique license for it. You have been told to set this up on an AWS EC2 instance; however, one of the problems is that the software license has to be tied to a specific MAC address and from your experience with AWS you know that every time an instance is restarted it will almost certainly lose it’s MAC address. What would be a possible solution to this given the options below?

Choose the correct answer:

You’ve created a temporary application that accepts image uploads, stores them in S3, and records information about the image in RDS. After building this architecture and accepting images for the duration required, it’s time to delete the CloudFormation template. However, your manager has informed you that for archival reasons the RDS data needs to be stored and the S3 bucket with the images needs to remain. Your manager has also instructed you to ensure that the application can be restored by a CloudFormation template and run next year during the same period.

Knowing that when a CloudFormation template is deleted, it will remove the resources it created, what is the best method for achieving the desired goals?

Choose the correct answer:

BCJC is managing a customer’s application which currently includes a three-tier application configuration. The first tier manages the web instances and is configured in a public subnet. The second layer is the application layer. As part of the application code, the application instances upload large amounts of data to Amazon S3. Currently, the private subnets that the application instances are running on have a route to a single NAT t2.micro NAT instance.

The application, during peak loads, becomes slow and customer uploads from the application to S3 are not completing and taking a long time.

Which steps might you take to solve the issue using the most cost efficient method?

Choose the correct answer:

You are the administrator for a new startup company which has a production account and a development account on AWS. Up until this point, no one has had access to the production account except yourself. There are 20 people on the development account who now need various levels of access provided to them on the production account. 10 of them need read-only access to all resources on the production account, 5 of them need read/write access to EC2 resources, and the remaining 5 only need read-only access to S3 buckets. Which of the following options would be the best way, both practically and security-wise, to accomplish this task?

Choose the correct answer:

You have a legacy application running that uses an m4.large instance size and cannot scale with Auto Scaling, but only has peak performance 5% of the time. This is a huge waste of resources and money so your Senior Technical Manager has set you the task of trying to reduce costs while still keeping the legacy application running as it should. Which of the following would best accomplish the task your manager has set you?

Choose the correct answer:

BCJC (Big Cloud Jumbo Corp) is designing a high availability solution for a customer. This customer’s requirements are that their application needs to be able to handle an unexpected amount of load and allow site visitors to read data from a DynamoDB table, which contains the results of an online polling system. Given this information, what would be the best and most cost-saving method for architecting and developing this application?

Choose the correct answer:

BCJC has developed a Ruby on Rails content management platform. Currently, BCJC is using OpsWorks with several stacks for dev, staging, and production to deploy and manage the application.

BCJC is about to implement a new feature on the CMS application using Python instead of Ruby.

How should BCJC deploy this new application feature?

Choose the correct answer:

You’ve been tasked with creating file level restore on your EC2 instances. You need to be able to restore an individual lost file on an EC2 instance within 15 minutes of a reported loss of information. The acceptable RPO is several hours. How would you perform this on an EC2 instance?

Choose the correct answer:

BCJC is running a web application that has a high amount of dynamic content. BCJC is looking to reduce load time by implementing a caching solution that will help reduce load times for clients requesting the application. What is the best possible solution and why?

Choose the correct answer:

Big Brother Bank has been acquiring smaller banks. BBB has a security requirement that all bank employees are required to log into a central identity solution, so that when they log on they gain access to central bank resources. Given that each bank has their own AWS account, and existing application instances with which to run their bank software, how would BBB connect each bank’s AWS networks to the central VPC, as to allow each bank to use the central identity solution?

Each bank runs their VPC in the US-West-1 region, requires a high availability solution, and regulation does not allow each bank access to the others’ resources. How would you best design this solution?

Choose the correct answer:

You’re consulting for a new customer, who is attempting to create a hybrid network between AWS and their on-premise data centers. Currently, they have internal databases running on-premise that, due to licensing reasons, cannot be migrated to AWS. The front end of the application has been migrated to AWS and uses the DB hostname “db.internalapp.local” to communicate with the on-premise database servers. Hostnames provide an easy method for updating IP addresses in event of failover instead of having to update the IP address in the code.

Given the current architecture what is the best way to configure internal DNS for this hybrid application? (Choose Two)

Choose the 2 correct answers:

The company you work for has a huge amount of infrastructure built on AWS. However there has been some concerns recently about the security of this infrastructure, and an external auditor has been given the task of running a thorough check of all of your company’s AWS assets. The auditor will be in the USA while your company’s infrastructure resides in the Asia Pacific (Sydney) region on AWS. Initially, he needs to check all of your VPC assets, specifically, security groups and NACLs You have been assigned the task of providing the auditor with a login to be able to do this. Which of the following would be the best and most secure solution to provide the auditor with so he can begin his initial investigations?

Choose the correct answer:

BCJC is hosting an Nginx web application. They want to use EMR to create EMR jobs that shift through all of the web server logs and error logs to pull statistics on click stream and errors based off of client IP address.

Given the requirements what would be the best method for collecting the log data and analyzing it automatically?

Choose the correct answer:

. BCJC is building out an AWS Cloud Environment for a financial regulatory firm. Part of the requirements are being able to monitor all changes in an environment and all traffic sent to and from the environment.

What suggestions would you make to ensure all the requirements for monitoring the financial architecture are satisfied? (Choose Two)

Choose the 2 correct answers:

Due to cost-cutting measurements being implemented by your organization, you have been told that you need to migrate some of your existing resources to another region. The first task you have been given is to copy all of your Amazon Machine Images from Asia Pacific (Sydney) to US West (Oregon). One of the things that you are unsure of is how the PEM keys on your Amazon Machine Images need to be migrated. Which of the following best describes how your PEM keys are affected when AMIs are migrated between regions?

Choose the correct answer:

You are excited that your company has just purchased a Direct Connect link from AWS as everything you now do on AWS should be much faster and more reliable. Your company is based in Sydney, Australia so obviously the Direct Connect Link to AWS will go into the Asia Pacific (Sydney) region. Your first job after the new link purchase is to create a multi-region design across the Asia Pacific(Sydney) region and the US West (N. California) region. You soon discover that all the infrastructure you deploy in the Asia Pacific(Sydney) region is extremely fast and reliable, however the infrastructure you deploy in the US West(N. California) region is much slower and unreliable. Which of the following would be the best option to make the US West(N. California) region a more reliable connection?

Choose the correct answer:

After configuring a whole site CDN on CloudFront you receive the following error: This distribution is not configured to allow the HTTP request method that was used for this request. The distribution supports only cachable requests.

What is the most likely cause of this?

Choose the correct answer:

In an attempt to cut costs your accounts manager has come to you and tells you that he thinks that if the company starts to use consolidated billing that it will save some money. He also wants the billing set up in such a way that it is relatively simple, and it gives insights into the environment regarding utilization of resources. Which of the following consolidated billing setups would satisfy your account manager’s needs?

Choose the 2 correct answers:

Your final task that will complete a cloud migration for a customer is to set up an Active Directory service for him so that he can use Microsoft Active Directory with the newly-deployed AWS services. After reading the AWS documentation for this, you discover there are 3 options available to set up the AWS Directory Service. You call the customer for more information about his requirements, and he tells you he has 10,000 users on his AD service and wants to be able to use his existing on-premises directory with AWS services. Which of the following options for setting up the AWS Directory Service would be the most appropriate for your customer?

Choose the correct answer:

. BCJC has two batch processing applications that consume financial data about the day’s stock transactions. Each transaction needs to be stored durably and guarantee that a record of each application is delivered so the audit and billing batch processing applications can process the data. However, the two applications run separately and several hours apart and need access to the same transaction information. After reviewing the transaction information for the day, the information no longer needs to be stored.

What is the best way to architect this application?

Choose the correct answer:

After the Government organization you work for suffers it’s 3rd DDOS attack of the year you have been handed one part of a strategy to try and stop this from happening again. You have been told that your job is to minimize the attack surface area. You do have a vague idea of some of the things you need to put in place to achieve this. Which of the following is NOT one of the ways to minimize the attack surface area as a DDOS minimization strategy?

Choose the correct answer:

You have created a VPC with CIDR block 10.0.0.0/24, which supports 256 IP addresses. You want to now split this into two subnets, each supporting 128 IP addresses. Can this be done and if so how will the allocation of IP addresses be configured?

Choose the correct answer:

BCJC has an employee that keeps terminating EC2 instances on the production environment. You’ve determined the best way to ensure this doesn’t happen is to add an extra layer of defense against terminating the instances. What is the best method to ensure the employee does not terminate the production instances?

Choose the 2 correct answers:

BCJC has many employees who need to run internal applications that access the company’s AWS resources. These employees already have user credentials in the company’s current identity authentication system, which does not support SAML 2.0. The company does not want to create a separate IAM user for each company employee.

How should the SSO setup be designed?

Choose the 2 correct answers:

The Dynamic Host Configuration Protocol (DHCP) provides a standard for passing configuration information to hosts on a TCP/IP network. You can have multiple sets of DHCP options, but you can associate only one set of DHCP options with a VPC at a time. You have just created your first set of DHCP options, associated it with your VPC but now realize that you have made an error in setting them up and you need to change the options. Which of the following options do you need to take to achieve this?

Choose the correct answer:

BCJC is running Oracle DB workloads on AWS. Currently, they are running the Oracle RAC configuration on the AWS public cloud. You’ve been tasked with configuring backups on the RAC cluster to enable durability. What is the best method for configuring backups?

Choose the correct answer:

You have been given the task of designing a backup strategy for your organization’s AWS resources with the only caveat being that you must use the AWS Storage Gateway. Which of the following is the most correct statement surrounding the backup strategy on the AWS Storage Gateway?

Choose the correct answer:

When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a subnet can be the same as the CIDR block for the VPC (for a single subnet in the VPC), or a subset (to enable multiple subnets). The allowed block size is between a /28 netmask and /16 netmask. You decide to you create a VPC with CIDR block 10.0.0.0/24. Therefore what is the maximum allowed number of IP addresses and the minimum allowed number of IP addresses according to AWS and what is the number of IP addresses supported by the VPC you created?

Choose the correct answer:

You’ve configured an AWS VPC and several EC2 instances running MongoDB with an internal IP address of 10.0.2.1. To simplify failover and connectivity to the instance, you create an internal Route 53 A record called mongodb.example.com. You have a VPN connection from on-premise to your VPC and are attempting to connect an on-premise VMWare instance to mongodb.example.com, but the DNS will not resolve.

Given the current design, why is the internal DNS record not resolving on-premise?

Choose the correct answer:

BCJC is running an Amazon Redshift cluster with four nodes running 24/7/365 and expects, potentially, to add one on-demand node for one to two days once during the year. Which architecture would have the lowest possible cost for the cluster requirement?

Choose the correct answer:

An online gaming server in which you have recently increased it’s IOPS performance, by creating a RAID 0 configuration has now started to have bottleneck problems due to your instance bandwidth. Which of the following would be the best solution for this to increase throughput?

Choose the correct answer:

BCJC has three consolidated billing accounts; dev, staging, and production. The dev account has purchased two reserved instances with instance type of m4.large in Availability Zone 1a. However, no instances are running on the dev account, but a m4.large is running in the staging account inside of availability zone 1a. Who can receive the pricing?

Choose the correct answer:

BCJC has a Redshift cluster for petabyte-scale data warehousing. The data within the cluster is easily reproducible from additional data stored on Amazon S3. BCJC wants to reduce the overall total cost of running this Redshift cluster. Which scenario would best meet the needs of the running cluster, while still reducing total overall ownership of the cluster?

Choose the correct answer:

BCJC is running a MySQL RDS instance inside of AWS; however, a new requirement for disaster recovery is keeping a read replica of the production RDS instance in an on-premise data center. What is the securest way of performing this replication?

Choose the correct answer: