Question 1

An organization is planning to extend their data center by connecting their DC with the AWS VPC using the VPN gateway. The organization is setting up a dynamically routed VPN connection. Which of the below mentioned answers is not required to setup this configuration?

Accepted Answer

Elastic IP ranges that the organization wants to advertise over the VPN connection to the VPC are not required for setting up a dynamically routed VPN connection. The other options are necessary for configuring the VPN connection.

Question 2

While implementing the policy keys in AWS Direct Connect, if you use and the request comes from an Amazon EC2 instance, the instance's public IP address is evaluated to determine if access is allowed.

Accepted Answer

The `aws:SourceIp` condition key is used to evaluate the public IP address of the request source, such as an Amazon EC2 instance, to determine if access is allowed.

Question 3

In the Amazon RDS Oracle DB engine, the Database Diagnostic Pack and the Database Tuning Pack are only available with __________.

Accepted Answer

The Database Diagnostic Pack and the Database Tuning Pack are features that are only available with the Oracle Enterprise Edition in Amazon RDS.

Question 4

A benefits enrollment company is hosting a 3-tier web application running in a VPC on AWS which includes a NAT (Network Address Translation) instance in the public Web tier. There is enough provisioned capacity for the expected workload tor the new fiscal year benefit enrollment period plus some extra overhead Enrollment proceeds nicely for two days and then the web tier becomes unresponsive, upon investigation using CloudWatch and other monitoring tools it is discovered that there is an extremely large and unanticipated amount of inbound traffic coming from a set of 15 specific IP addresses over port 80 from a country where the benefits company has no customers. The web tier instances are so overloaded that benefit enrollment administrators cannot even SSH into them. Which activity would be useful in defending against this attack?

Accepted Answer

Network Access Control Lists (NACLs) are stateless and can be used to block specific IP addresses at the subnet level, which is effective in this scenario to block the attacking IPs.

Question 5

An organization is setting a website on the AWS VPC. The organization has blocked a few IPs to avoid a D-DOS attack. How can the organization configure that a request from the above mentioned IPs does not access the application instances?

Accepted Answer

Network ACLs (Access Control Lists) are used to control traffic at the subnet level and can be configured to deny traffic from specific IP addresses, making them suitable for blocking unwanted IPs.

Question 6

An organization is creating a VPC for their application hosting. The organization has created two private subnets in the same AZ and created one subnet in a separate zone. The organization wants to make a HA system with the internal ELB. Which of these statements is true with respect to an internal ELB in this scenario?

Accepted Answer

An ELB can support only one subnet per availability zone.

Question 7

Select the correct set of options. These are the initial settings for the default security group:

Accepted Answer

The default security group allows no inbound traffic, allows all outbound traffic, and allows instances associated with the security group to communicate with each other.

Question 8

In Amazon ElastiCache, the failure of a single cache node can have an impact on the availability of your application and the load on your back-end database while ElastiCache provisions a replacement for the failed cache node and it get repopulated. Which of the following is a solution to reduce this potential availability impact?

Accepted Answer

Spreading memory and compute capacity over a larger number of smaller cache nodes reduces the impact of a single node failure, as the load is distributed more evenly and the failure of one node affects a smaller portion of the total cache.

Question 9

An organization is planning to host a Wordpress blog as well a joomla CMS on a single instance launched with VPC. The organization wants to have separate domains for each application and assign them using Route 53. The organization may have about ten instances each with two applications as mentioned above. While launching the instance, the organization configured two separate network interfaces (primary + ENI) and wanted to have two elastic IPs for that instance. It was suggested to use a public IP from AWS instead of an elastic IP as the number of elastic IPs is restricted. What action will you recommend to the organization?

Accepted Answer

AWS does not assign a public IP to an instance with multiple ENIs; therefore, an elastic IP is required for each ENI to ensure consistent IP addresses.

Question 10

A user authenticating with Amazon Cognito will go through a multi-step process to bootstrap their credentials. Amazon Cognito has two different flows for authentication with public providers. Which of the following are the two flows?

Accepted Answer

The answer of A user authenticating with Amazon Cognito will...

Question 11

Which of the following are characteristics of Amazon VPC subnets? (Choose two.)

Accepted Answer

Each subnet in an Amazon VPC is associated with a single Availability Zone. By default, all subnets within a VPC can route between each other, regardless of whether they are private or public.

Question 12

In which step of using AWS Direct Connect should the user determine the required port speed?

Accepted Answer

The user should determine the required port speed when submitting the AWS Direct Connect Connection Request, as this information is needed to establish the connection.

Question 13

Your company has recently extended its datacenter into a VPC on AWS to add burst computing capacity as needed Members of your Network Operations Center need to be able to go to the AWS Management Console and administer Amazon EC2 instances as necessary. You don't want to create new IAM users for each NOC member and make those users sign in again to the AWS Management Console. Which option below will meet the needs for your NOC members?

Accepted Answer

Using a SAML 2.0-compliant identity provider (IDP) allows federated access to the AWS Management Console via AWS SSO, enabling users to sign in without creating separate IAM users.

Question 14

In Amazon IAM, what is the maximum length for a role name?

Accepted Answer

The maximum length for a role name in Amazon IAM is 64 characters.

Question 15

In AWS, which security aspects are the customer's responsibility? (Choose four.)

Accepted Answer

The answer of In AWS, which security aspects are the...

Question 16

Which of the following is the Amazon Resource Name (ARN) condition operator that can be used within an Identity and Access Management (IAM) policy to check the case-insensitive matching of the ARN?

Accepted Answer

The "ArnLike" condition operator in IAM policies is used to perform case-insensitive matching of ARNs.

Question 17

How can multiple compute resources be used on the same pipeline in AWS Data Pipeline?

Accepted Answer

You can define multiple cluster objects in the pipeline definition and specify which cluster each activity should run on using the "runsOn" field.

Question 18

One of your AWS Data Pipeline activities has failed consequently and has entered a hard failure state after retrying thrice. You want to try it again. Is it possible to increase the number of automatic retries to more than thrice?

Accepted Answer

The answer of One of your AWS Data Pipeline activities...

Question 19

An organization (account ID 123412341234) has configured the IAM policy to allow the user to modify his credentials. What will the below mentioned statement allow the user to perform?

Accepted Answer

The answer of An organization (account ID 123412341234) has configured...

Question 20

If no explicit deny is found while applying IAM's Policy Evaluation Logic, the enforcement code looks for any ______ instructions that would apply to the request.

Accepted Answer

The IAM Policy Evaluation Logic checks for "allow" instructions if no explicit deny is found, to determine if the request should be permitted.

Exam 10: AWS Certified Solutions Architect - Professional (SAP-C01)