SOA-C01 : AWS-SysOps : ​​​​​Part 05

SOA-C01 : AWS-SysOps ​​​​​: Part 05

1. A system admin is planning to setup event notifications on RDS. Which of the below mentioned services will help the admin setup notifications?

   • AWS SES
   • AWS Cloudtrail
   • AWS Cloudwatch
   • AWS SNS
   Explanation:
   Amazon RDS uses the Amazon Simple Notification Service to provide a notification when an Amazon RDS event occurs. These notifications can be in any notification form supported by Amazon SNS for an AWS region, such as an email, a text message or a call to an HTTP endpoint

2. You are building an online store on AWS that uses SQS to process your customer orders. Your backend system needs those messages in the same sequence the customer orders have been put in. How can you achieve that?

   • It is not possible to do this with SQS
   • You can use sequencing information on each message
   • You can do this with SQS but you also need to use SWF
   • Messages will arrive in the same order by default
   Explanation:
   Amazon SQS is engineered to always be available and deliver messages. One of the resulting tradeoffs is that SQSdoes not guarantee first in, first out delivery of messages. For many distributed applications, each message can stand on its own, and as long as all messages are delivered, the order is not important. If your system requires that order be preserved, you can place sequencing information in each message, so that you can reorder the messages when the queue returns them.

3. An organization wants to move to Cloud. They are looking for a secure encrypted database storage option. Which of the below mentioned AWS functionalities helps them to achieve this?

   • AWS MFA with EBS
   • AWS EBS encryption
   • Multi-tier encryption with Redshift
   • AWS S3 server side storage
   Explanation:
   AWS EBS supports encryption of the volume while creating new volumes. It also supports creating volumes from existing snapshots provided the snapshots are created from encrypted volumes. The data at rest, the I/O as well as all the snapshots of EBS will be encrypted. The encryption occurs on the servers that host the EC2 instances, providing encryption of data as it moves between the EC2 instances and EBS storage. EBS encryption is based on the AES-256 cryptographic algorithm, which is the industry standard

4. A user wants to disable connection draining on an existing ELB. Which of the below mentioned statements helps the user disable connection draining on the ELB?

   • The user can only disable connection draining from CLI
   • It is not possible to disable the connection draining feature once enabled
   • The user can disable the connection draining feature from EC2 -> ELB console or from CLI
   • The user needs to stop all instances before disabling connection draining
   Explanation:
   The Elastic Load Balancer connection draining feature causes the load balancer to stop sending new requests to the back-end instances when the instances are deregistering or become unhealthy, while ensuring that inflight requests continue to be served. The user can enable or disable connection draining from the AWS EC2 console -> ELB or using CLI.

5. A user has a refrigerator plant. The user is measuring the temperature of the plant every 15 minutes. If the user wants to send the data to CloudWatch to view the data visually, which of the below mentioned statements is true with respect to the information given above?

   • The user needs to use AWS CLI or API to upload the data
   • The user can use the AWS Import Export facility to import data to CloudWatch
   • The user will upload data from the AWS console
   • The user cannot upload data to CloudWatch since it is not an AWS service metric
   Explanation:
   AWS CloudWatch supports the custom metrics. The user can always capture the custom data and upload the data to CloudWatch using CLI or APIs. While sending the data the user has to include the metric name, namespace and timezone as part of the request.

6. A system admin is managing buckets, objects and folders with AWS S3. Which of the below mentioned statements is true and should be taken in consideration by the sysadmin?

   • The folders support only ACL
   • Both the object and bucket can have an Access Policy but folder cannot have policy
   • Folders can have a policy
   • Both the object and bucket can have ACL but folders cannot have ACL
   Explanation:
   Amazon S3 Access Control Lists (ACLs) enable you to manage access to buckets and objects. Each bucket and object has an ACL attached to it as a subresource. It defines which AWS accounts or groups are granted access and the type of access. When a request is received against a resource, Amazon S3 checks the corresponding ACL to verify the requester has the necessary access permissions.
   Reference: http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html

7. A user has created an ELB with three instances. How many security groups will ELB create by default?

   • 3
   • 5
   • 2
   • 1
   Explanation:
   Elastic Load Balancing provides a special Amazon EC2 source security group that the user can use to ensure that back-end EC2 instances receive traffic only from Elastic Load Balancing. This feature needs two security groups: the source security group and a security group that defines the ingress rules for the back-end instances. To ensure that traffic only flows between the load balancer and the back-end instances, the user can add or modify a rule to the back-end security group which can limit the ingress traffic. Thus, it can come only from the source security group provided by Elastic Load Balancing.

8. An organization has created 50 IAM users. The organization wants that each user can change their password but cannot change their access keys. How can the organization achieve this?

   • The organization has to create a special password policy and attach it to each user
   • The root account owner has to use CLI which forces each IAM user to change their password on first login
   • By default each IAM user can modify their passwords
   • The root account owner can set the policy from the IAM console under the password policy screen
   Explanation:
   With AWS IAM, organizations can use the AWS Management Console to display, create, change or delete a password policy. As a part of managing the password policy, the user can enable all users to manage their own passwords. If the user has selected the option which allows the IAM users to modify their password, he does not need to set a separate policy for the users. This option in the AWS console allows changing only the password.

9. A user has created a photo editing software and hosted it on EC2. The software accepts requests from the user about the photo format and resolution and sends a message to S3 to enhance the picture accordingly. Which of the below mentioned AWS services will help make a scalable software with the AWS infrastructure in this scenario?

   • AWS Glacier
   • AWS Elastic Transcoder
   • AWS Simple Notification Service
   • AWS Simple Queue Service
   Explanation:
   Amazon Simple Queue Service (SQS. is a fast, reliable, scalable, and fully managed message queuing service. SQS provides a simple and cost-effective way to decouple the components of an application. The user can configure SQS, which will decouple the call between the EC2 application and S3. Thus, the application does not keep waiting for S3 to provide the data.

10. An application is generating a log file every 5 minutes. The log file is not critical but may be required only for verification in case of some major issue. The file should be accessible over the internet whenever required. Which of the below mentioned options is a best possible storage solution for it?

    • AWS S3
    • AWS Glacier
    • AWS RDS
    • AWS RRS
    Explanation:
    Amazon S3 stores objects according to their storage class. There are three major storage classes: Standard, Reduced Redundancy Storage and Glacier. Standard is for AWS S3 and provides very high durability. However, the costs are a little higher. Glacier is for archival and the files are not available over the internet. Reduced Redundancy Storage is for less critical files. Reduced Redundancy is little cheaper as it provides less durability in comparison to S3. In this case since the log files are not mission critical files, RRS will be a better option.

11. A user has created a VPC with CIDR 20.0.0.0/24. The user has created a public subnet with CIDR 20.0.0.0/25. The user is trying to create the private subnet with CIDR 20.0.0.128/25. Which of the below mentioned statements is true in this scenario?

    • It will not allow the user to create the private subnet due to a CIDR overlap
    • It will allow the user to create a private subnet with CIDR as 20.0.0.128/25
    • This statement is wrong as AWS does not allow CIDR 20.0.0.0/25
    • It will not allow the user to create a private subnet due to a wrong CIDR range
    Explanation:
    When the user creates a subnet in VPC, he specifies the CIDR block for the subnet. The CIDR block of a subnet can be the same as the CIDR block for the VPC (for a single subnet in the VPC., or a subset (to enable multiple subnets. If the user creates more than one subnet in a VPC, the CIDR blocks of the subnets must not overlap. Thus, in this case the user has created a VPC with the CIDR block 20.0.0.0/24, which supports 256 IP addresses (20.0.0.0 to 20.0.0.255. The user can break this CIDR block into two subnets, each supporting 128 IP addresses. One subnet uses the CIDR block 20.0.0.0/25 (for addresses 20.0.0.0 – 20.0.0.127. and the other uses the CIDR block 20.0.0.128/25 (for addresses 20.0.0.128 – 20.0.0.255.

12. A user has created an S3 bucket which is not publicly accessible. The bucket is having thirty objects which are also private. If the user wants to make the objects public, how can he configure this with minimal efforts?

    • The user should select all objects from the console and apply a single policy to mark them public
    • The user can write a program which programmatically makes all objects public using S3 SDK
    • Set the AWS bucket policy which marks all objects as public
    • Make the bucket ACL as public so it will also mark all objects as public
    Explanation:
    A system admin can grant permission of the S3 objects or buckets to any user or make the objects public using the bucket policy and user policy. Both use the JSON-based access policy language. Generally, if the user is defining the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be defined at the bucket level which allows the objects as well as the bucket to be public with a single policy applied to that bucket.

13. A sys admin is maintaining an application on AWS. The application is installed on EC2 and user has configured ELB and Auto Scaling. Considering future load increase, the user is planning to launch new servers proactively so that they get registered with ELB. How can the user add these instances with Auto Scaling?

    • Increase the desired capacity of the Auto Scaling group
    • Increase the maximum limit of the Auto Scaling group
    • Launch an instance manually and register it with ELB on the fly
    • Decrease the minimum limit of the Auto Scaling group
    Explanation:
    A user can increase the desired capacity of the Auto Scaling group and Auto Scaling will launch a new instance as per the new capacity. The newly launched instances will be registered with ELB if Auto Scaling group is configured with ELB. If the user decreases the minimum size the instances will be removed from Auto Scaling. Increasing the maximum size will not add instances but only set the maximum instance cap.

14. An organization, which has the AWS account ID as 999988887777, has created 50 IAM users. All the users are added to the same group cloudacademy. If the organization has enabled that each IAM user can login with the AWS console, which AWS login URL will the IAM users use?

    • https:// 999988887777.signin.aws.amazon.com/console/
    • https:// signin.aws.amazon.com/cloudacademy/
    • https:// cloudacademy.signin.aws.amazon.com/999988887777/console/
    • https:// 999988887777.aws.amazon.com/ cloudacademy/
    Explanation:
    AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. Once the organization has created the IAM users, they will have a separate AWS console URL to login to the AWS console. The console login URL for the IAM user will be https:// AWS_Account_ID.signin.aws.amazon.com/console/. It uses only the AWS account ID and does not depend on the group or user ID.

15. A user has setup connection draining with ELB to allow in-flight requests to continue while the instance is being deregistered through Auto Scaling. If the user has not specified the draining time, how long will ELB allow inflight requests traffic to continue?

    • 600 seconds
    • 3600 seconds
    • 300 seconds
    • 0 seconds
    Explanation:
    The Elastic Load Balancer connection draining feature causes the load balancer to stop sending new requests to the back-end instances when the instances are deregistering or become unhealthy, while ensuring that inflight requests continue to be served. The user can specify a maximum time (3600 seconds. for the load balancer to keep the connections alive before reporting the instance as deregistered. If the user does not specify the maximum timeout period, by default, the load balancer will close the connections to the deregistering instance after 300 seconds.

16. A root AWS account owner is trying to understand various options to set the permission to AWS S3. Which of the below mentioned options is not the right option to grant permission for S3?

    • User Access Policy
    • S3 Object Access Policy
    • S3 Bucket Access Policy
    • S3 ACL
    Explanation:
    Amazon S3 provides a set of operations to work with the Amazon S3 resources. Managing S3 resource access refers to granting others permissions to work with S3. There are three ways the root account owner can define access with S3:
    S3 ACL: The user can use ACLs to grant basic read/write permissions to other AWS accounts.
    S3 Bucket Policy: The policy is used to grant other AWS accounts or IAM users permissions for the bucket and the objects in it.
    User Access Policy: Define an IAM user and assign him the IAM policy which grants him access to S3.

17. A sys admin has created a shopping cart application and hosted it on EC2. The EC2 instances are running behind ELB. The admin wants to ensure that the end user request will always go to the EC2 instance where the user session has been created. How can the admin configure this?

    • Enable ELB cross zone load balancing
    • Enable ELB cookie setup
    • Enable ELB sticky session
    • Enable ELB connection draining
    Explanation:
    Generally, AWS ELB routes each request to a zone with the minimum load. The Elastic Load Balancer provides a feature called sticky session which binds the user’s session with a specific EC2 instance. If the sticky session is enabled the first request from the user will be redirected to any of the EC2 instances. But, henceforth, all requests from the same user will be redirected to the same EC2 instance. This ensures that all requests coming from the user during the session will be sent to the same application instance.

18. A user has configured ELB with three instances. The user wants to achieve High Availability as well as redundancy with ELB. Which of the below mentioned AWS services helps the user achieve this for ELB?

    • Route 53
    • AWS Mechanical Turk
    • Auto Scaling
    • AWS EMR
    Explanation:
    The user can provide high availability and redundancy for applications running behind Elastic Load Balancer by enabling the Amazon Route 53 Domain Name System (DNS. failover for the load balancers. Amazon Route 53 is a DNS service that provides reliable routing to the user’s infrastructure.

19. An organization is using AWS since a few months. The finance team wants to visualize the pattern of AWS spending. Which of the below AWS tool will help for this requirement?

    • AWS Cost Manager
    • AWS Cost Explorer
    • AWS CloudWatch
    • AWS Consolidated Billing
    Explanation:
    The AWS Billing and Cost Management console includes the Cost Explorer tool for viewing AWS cost data as a graph. It does not charge extra to user for this service. With Cost Explorer the user can filter graphs using resource tags or with services in AWS. If the organization is using Consolidated Billing, it helps generate report based on linked accounts. This will help organization to identify areas that require further inquiry. The organization can view trends and use that to understand spend and to predict future costs.

20. A user has launched an ELB which has 5 instances registered with it. The user deletes the ELB by mistake. What will happen to the instances?

    • ELB will ask the user whether to delete the instances or not
    • Instances will be terminated
    • ELB cannot be deleted if it has running instances registered with it
    • Instances will keep running
    Explanation:
    When the user deletes the Elastic Load Balancer, all the registered instances will be deregistered. However, they will continue to run. The user will incur charges if he does not take any action on those instances.