SAP-C01 : AWS Certified Solutions Architect – Professional : Part 07

SAP-C01 : AWS Certified Solutions Architect – Professional : Part 07

  1. An organization is planning to extend their data center by connecting their DC with the AWS VPC using the VPN gateway. The organization is setting up a dynamically routed VPN connection.

    Which of the below mentioned answers is not required to setup this configuration?

    • The type of customer gateway, such as Cisco ASA, Juniper J-Series, Juniper SSG, Yamaha.
    • Elastic IP ranges that the organization wants to advertise over the VPN connection to the VPC.
    • Internet-routable IP address (static) of the customer gateway’s external interface.
    • Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the customer gateway.
    Explanation:
    The Amazon Virtual Private Cloud (Amazon VPC) allows the user to define a virtual networking environment in a private, isolated section of the Amazon Web Services (AWS) cloud. The user has complete control over the virtual networking environment. The organization wants to extend their network into the cloud and also directly access the internet from their AWS VPC. Thus, the organization should setup a Virtual Private Cloud (VPC) with a public subnet and a private subnet, and a virtual private gateway to enable communication with their data center network over an IPsec VPN tunnel. To setup this configuration the organization needs to use the Amazon VPC with a VPN connection. The organization network administrator must designate a physical appliance as a customer gateway and configure it. The organization would need the below mentioned information to setup this configuration:
    The type of customer gateway, such as Cisco ASA, Juniper J-Series, Juniper SSG, Yamaha Internet-routable IP address (static) of the customer gateway’s external interface Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the customer gateway, if the organization is creating a dynamically routed VPN connection. Internal network IP ranges that the user wants to advertise over the VPN connection to the VPC.

  2. In the context of AWS IAM, identify a true statement about user passwords (login profiles).

    • They must contain Unicode characters.
    • They can contain any Basic Latin (ASCII) characters.
    • They must begin and end with a forward slash (/).
    • They cannot contain Basic Latin (ASCII) characters.
    Explanation:
    The user passwords (login profiles) of IAM users can contain any Basic Latin (ASCII)characters.

  3. An organization is planning to host a WordPress blog as well a joomla CMS on a single instance launched with VPC. The organization wants to have separate domains for each application and assign them using Route 53. The organization may have about ten instances each with two applications as mentioned above. While launching the instance, the organization configured two separate network interfaces (primary + ENI) and wanted to have two elastic IPs for that instance. It was suggested to use a public IP from AWS instead of an elastic IP as the number of elastic IPs is restricted.

    What action will you recommend to the organization?

    • I agree with the suggestion but will prefer that the organization should use separate subnets with each ENI for different public IPs.
    • I do not agree as it is required to have only an elastic IP since an instance has more than one ENI and AWS does not assign a public IP to an instance with multiple ENIs.
    • I do not agree as AWS VPC does not attach a public IP to an ENI; so the user has to use only an elastic IP only.
    • I agree with the suggestion and it is recommended to use a public IP from AWS since the organization is going to use DNS with Route 53.
    Explanation:
    A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account. It enables the user to launch AWS resources into a virtual network that the user has defined. An Elastic Network Interface (ENI) is a virtual network interface that the user can attach to an instance in a VPC. The user can attach up to two ENIs with a single instance. However, AWS cannot assign a public IP when there are two ENIs attached to a single instance. It is recommended to assign an elastic IP in this scenario. If the organization wants more than 5 EIPs they can request AWS to increase the number.

  4. What is the default maximum number of VPCs allowed per region?

    • 5
    • 10
    • 100
    • 15
    Explanation:
    The maximum number of VPCs allowed per region is 5.

  5. A customer has a website which shows all the deals available across the market. The site experiences a load of 5 large EC2 instances generally.
    However, a week before Thanksgiving vacation they encounter a load of almost 20 large instances. The load during that period varies over the day based on the office timings.

    Which of the below mentioned solutions is cost effective as well as help the website achieve better performance?

    • Setup to run 10 instances during the pre-vacation period and only scale up during the office time by launching 10 more instances using the AutoScaling schedule.
    • Keep only 10 instances running and manually launch 10 instances every day during office hours.
    • During the pre-vacation period setup 20 instances to run continuously.
    • During the pre-vacation period setup a scenario where the organization has 15 instances running and 5 instances to scale up and down using Auto Scaling based on the network I/O policy.
    Explanation:
    AWS provides an on demand, scalable infrastructure. AWS EC2 allows the user to launch On- Demand instances and the organization should create an AMI of the running instance. When the organization is experiencing varying loads and the time of the load is not known but it is higher than the routine traffic it is recommended that the organization launches a few instances beforehand and then setups AutoScaling with policies which scale up and down as per the EC2 metrics, such as Network I/O or CPU utilization. If the organization keeps all 10 additional instances as a part of the AutoScaling policy sometimes during a sudden higher load it may take time to launch instances and may not give an optimal performance. This is the reason it is recommended that the organization keeps an additional 5 instances running and the next 5 instances scheduled as per the AutoScaling policy for cost effectiveness.

  6. An organization is setting a website on the AWS VPC. The organization has blocked a few IPs to avoid a D-DOS attack.

    How can the organization configure that a request from the above mentioned IPs does not access the application instances?

    • Create an IAM policy for VPC which has a condition to disallow traffic from that IP address.
    • Configure a security group at the subnet level which denies traffic from the selected IP.
    • Configure the security group with the EC2 instance which denies access from that IP address.
    • Configure an ACL at the subnet which denies the traffic from that IP address.
    Explanation:
    A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account. It enables the user to launch AWS resources into a virtual network that the user has defined. AWS provides two features that the user can use to increase security in VPC: security groups and network ACLs. Security group works at the instance level while ACL works at the subnet level. ACL allows both allow and deny rules. Thus, when the user wants to reject traffic from the selected IPs it is recommended to use ACL with subnets.

  7. An organization has 4 people in the IT operations team who are responsible to manage the AWS infrastructure. The organization wants to setup that each user will have access to launch and manage an instance in a zone which the other user cannot modify.

    Which of the below mentioned options is the best solution to set this up?

    • Create four AWS accounts and give each user access to a separate account.
    • Create an IAM user and allow them permission to launch an instance of a different sizes only.
    • Create four IAM users and four VPCs and allow each IAM user to have access to separate VPCs.
    • Create a VPC with four subnets and allow access to each subnet for the individual IAM user.
    Explanation:
    A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account. The user can create subnets as per the requirement within a VPC. The VPC also work with IAM and the organization can create IAM users who have access to various VPC services. The organization can setup access for the IAM user who can modify the security groups of the VPC. The sample policy is given below:
    {
    “Version”: “2012-10-17”,
    “Statement”:
    [{ “Effect”: “Allow”,
    “Action”: “ec2:RunInstances”, “Resource”:
    [“arn:aws:ec2:region::image/ami-*”, “arn:aws:ec2:region:account:subnet/subnet-1a2b3c4d”, “arn:aws:ec2:region:account:network-interface/*”, “arn:aws:ec2:region:account:volume/*”, “arn:aws:ec2:region:account:key-pair/*”, “arn:aws:ec2:region:account:security-group/sg-123abc123” ] }]
    }
    With this policy the user can create four subnets in separate zones and provide IAM user access to each subnet.

  8. In which step of using AWS Direct Connect should the user determine the required port speed?An organization is planning to host an application on the AWS VPC. The organization wants dedicated instances. However, an AWS consultant advised the organization not to use dedicated instances with VPC as the design has a few limitations.

    Which of the below mentioned statements is not a limitation of dedicated instances with VPC?

    • All instances launched with this VPC will always be dedicated instances and the user cannot use a default tenancy model for them.
    • It does not support the AWS RDS with a dedicated tenancy VPC.
    • The user cannot use Reserved Instances with a dedicated tenancy model.
    • The EBS volume will not be on the same tenant hardware as the EC2 instance though the user has configured dedicated tenancy.
    Explanation:
    The Amazon Virtual Private Cloud (Amazon VPC) allows the user to define a virtual networking environment in a private, isolated section of the Amazon Web Services (AWS) cloud. The user has complete control over the virtual networking environment. Dedicated instances are Amazon EC2 instances that run in a Virtual Private Cloud (VPC) on hardware that is dedicated to a single customer. The client’s dedicated instances are physically isolated at the host hardware level from instances that are not dedicated instances as well as from instances that belong to other AWS accounts. All instances launched with the dedicated tenancy model of VPC will always be dedicated instances. Dedicated tenancy has a limitation that it may not support a few services, such as RDS. Even the EBS will not be on dedicated hardware. However, the user can save some cost as well as reserve some capacity by using a Reserved Instance model with dedicated tenancy.

  9. In which step of using AWS Direct Connect should the user determine the required port speed?

    • Complete the Cross Connect
    • Verify Your Virtual Interface
    • Download Router Configuration
    • Submit AWS Direct Connect Connection Request
    Explanation:
    To submit an AWS Direct Connect connection request, you need to provide the following information:
    Your contact information.
    The AWS Direct Connect Location to connect to.
    Details of AWS Direct Connect partner if you use the AWS Partner Network (APN) service. The port speed you require, either 1 Gbps or 10 Gbps.

  10. In Amazon IAM, what is the maximum length for a role name?

    • 128 characters
    • 512 characters
    • 64 characters
    • 256 characters
    Explanation:
    In Amazon IAM, the maximum length for a role name is 64 characters.

  11. A user is planning to host a web server as well as an app server on a single EC2 instance which is a part of the public subnet of a VPC.

    How can the user setup to have two separate public IPs and separate security groups for both the application as well as the web server?

    • Launch VPC with two separate subnets and make the instance a part of both the subnets.
    • Launch a VPC instance with two network interfaces. Assign a separate security group and elastic IP to them.
    • Launch a VPC instance with two network interfaces. Assign a separate security group to each and AWS will assign a separate public IP to them.
    • Launch a VPC with ELB such that it redirects requests to separate VPC instances of the public subnet.
    Explanation:
    If you need to host multiple websites (with different IPs) on a single EC2 instance, the following is the suggested method from AWS.
    Launch a VPC instance with two network interfaces.
    Assign elastic IPs from VPC EIP pool to those interfaces (Because, when the user has attached more than one network interface with an instance, AWS cannot assign public IPs to them.) Assign separate Security Groups if separate Security Groups are needed This scenario also helps for operating network appliances, such as firewalls or load balancers that have multiple private IP addresses for each network interface.

  12. You have subscribed to the AWS Business and Enterprise support plan.
    Your business has a backlog of problems, and you need about 20 of your IAM users to open technical support cases.

    How many users can open technical support cases under the AWS Business and Enterprise support plan?

    • 5 users
    • 10 users
    • Unlimited
    • 1 user
    Explanation:
    In the context of AWS support, the Business and Enterprise support plans allow an unlimited number of users to open technical support cases (supported by AWS Identity and Access Management (IAM)).

  13. While implementing the policy keys in AWS Direct Connect, if you use and the request comes from an Amazon EC2 instance, the instance’s public IP address is evaluated to determine if access is allowed.

    • aws:SecureTransport
    • aws:EpochIP
    • aws:SourceIp
    • aws:CurrentTime
    Explanation:
    While implementing the policy keys in Amazon RDS, if you use aws: SourceIp and the request comes from an Amazon EC2 instance, the instance’s public IP address is evaluated to determine if access is allowed.

  14. How many g2.2xlarge on-demand instances can a user run in one region without taking any limit increase approval from AWS?

    • 20
    • 2
    • 5
    • 10
    Explanation:
    Generally, AWS EC2 allows running 20 on-demand instances and 100 spot instances at a time. This limit can be increased by requesting at https://aws.amazon.com/contact-us/ec2-request. Excluding certain types of instances, the limit is lower than mentioned above. For g2.2xlarge, the user can run only 5 on-demand instance at a time.

  15. A user has created a MySQL RDS instance with PIOPS. Which of the below mentioned statements will help user understand the advantage of PIOPS?

    • The user can achieve additional dedicated capacity for the EBS I/O with an enhanced RDS option
    • It uses a standard EBS volume with optimized configuration the stacks
    • It uses optimized EBS volumes and optimized configuration stacks
    • It provides a dedicated network bandwidth between EBS and RDS
    Explanation:
    RDS DB instance storage comes in two types: standard and provisioned IOPS. Standard storage is allocated on the Amazon EBS volumes and connected to the user’s DB instance. Provisioned IOPS uses optimized EBS volumes and an optimized configuration stack. It provides additional, dedicated capacity for the EBS I/O.

  16. A user authenticating with Amazon Cognito will go through a multi-step process to bootstrap their credentials.
    Amazon Cognito has two different flows for authentication with public providers.

    Which of the following are the two flows?

    • Authenticated and non-authenticated
    • Public and private
    • Enhanced and basic
    • Single step and multistep
    Explanation:
    A user authenticating with Amazon Cognito will go through a multi-step process to bootstrap their credentials. Amazon Cognito has two different flows for authentication with public providers: enhanced and basic.

  17. Which of the following is the Amazon Resource Name (ARN) condition operator that can be used within an Identity and Access Management (IAM) policy to check the case-insensitive matching of the ARN?

    • ArnCheck
    • ArnMatch
    • ArnCase
    • ArnLike
    Explanation:
    Amazon Resource Name (ARN) condition operators let you construct Condition elements that restrict access based on comparing a key to an ARN. ArnLike, for instance, is a case-insensitive matching of the ARN. Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (*) or a single-character match wildcard (?).

  18. An organization is creating a VPC for their application hosting. The organization has created two private subnets in the same AZ and created one subnet in a separate zone.
    The organization wants to make a HA system with the internal ELB.

    Which of these statements is true with respect to an internal ELB in this scenario?

    • ELB can support only one subnet in each availability zone.
    • ELB does not allow subnet selection; instead it will automatically select all the available subnets of the VPC.
    • If the user is creating an internal ELB, he should use only private subnets.
    • ELB can support all the subnets irrespective of their zones.
    Explanation:
    The Amazon Virtual Private Cloud (Amazon VPC) allows the user to define a virtual networking environment in a private, isolated section of the Amazon Web Services (AWS) cloud.
    The user has complete control over the virtual networking environment. Within this virtual private cloud, the user can launch AWS resources, such as an ELB, and EC2 instances.
    There are two ELBs available with VPC: internet facing and internal (private) ELB. For internal servers, such as App servers the organization can create an internal load balancer in their VPC and then place back-end application instances behind the internal load balancer.
    The internal load balancer will route requests to the back-end application instances, which are also using private IP addresses and only accept requests from the internal load balancer.
    The Internal ELB supports only one subnet in each AZ and asks the user to select a subnet while configuring internal ELB.

  19. In Amazon ElastiCache, the failure of a single cache node can have an impact on the availability of your application and the load on your back-end database while ElastiCache provisions a replacement for the failed cache node and it get repopulated.

    Which of the following is a solution to reduce this potential availability impact?

    • Spread your memory and compute capacity over fewer number of cache nodes, each with smaller capacity.
    • Spread your memory and compute capacity over a larger number of cache nodes, each with smaller capacity.
    • Include fewer number of high capacity nodes.
    • Include a larger number of cache nodes, each with high capacity.
    Explanation:
    In Amazon ElastiCache, the number of cache nodes in the cluster is a key factor in the availability of your cluster running Memcached. The failure of a single cache node can have an impact on the availability of your application and the load on your back-end database while ElastiCache provisions a replacement for the failed cache node and it get repopulated.
    You can reduce this potential availability impact by spreading your memory and compute capacity over a larger number of cache nodes, each with smaller capacity, rather than using a fewer number of high capacity nodes.

  20. MapMySite is setting up a web application in the AWS VPC. The organization has decided to use an AWS RDS instead of using its own DB instance for HA and DR requirements.
    The organization also wants to secure RDS access.

    How should the web application be setup with RDS?

    • Create a VPC with one public and one private subnet. Launch an application instance in the public subnet while RDS is launched in the private subnet.
    • Setup a public and two private subnets in different AZs within a VPC and create a subnet group. Launch RDS with that subnet group.
    • Create a network interface and attach two subnets to it. Attach that network interface with RDS while launching a DB instance.
    • Create two separate VPCs and launch a Web app in one VPC and RDS in a separate VPC and connect them with VPC peering.
    Explanation:
    A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account. It enables the user to launch AWS resources, such as RDS into a virtual network that the user has defined. Subnets are segments of a VPC’s IP address range that the user can designate to a group of VPC resources based on the security and operational needs.
    A DB subnet group is a collection of subnets (generally private) that a user can create in a VPC and assign to the RDS DB instances. A DB subnet group allows the user to specify a particular VPC when creating the DB instances. Each DB subnet group should have subnets in at least two Availability Zones in a given region.
Subscribe
Notify of
guest
0 Comments
Newest
Oldest Most Voted
Inline Feedbacks
View all comments