Question 1

An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords. How can the organization achieve this?

Accepted Answer

IAM users within the same AWS account must have unique usernames. It is not possible to have the same login ID for multiple IAM users in the same account.

Question 2

What feature of the load balancing service attempts to force subsequent connections to a service to be redirected to the same node as long as it is online?

Accepted Answer

Session persistence, also known as "sticky sessions," ensures that subsequent connections from the same client are directed to the same server node, as long as it is online.

Question 3

An organization has 4 people in the IT operations team who are responsible to manage the AWS infrastructure. The organization wants to setup that each user will have access to launch and manage an instance in a zone which the other user cannot modify. Which of the below mentioned options is the best solution to set this up?

Accepted Answer

Creating a VPC with four subnets and allowing access to each subnet for the individual IAM user ensures that each user can manage their own instances without interfering with others.

Question 4

MapMySite is setting up a web application in the AWS VPC. The organization has decided to use an AWS RDS instead of using its own DB instance for HA and DR requirements. The organization also wants to secure RDS access. How should the web application be setup with RDS?

Accepted Answer

Setting up a public and two private subnets in different AZs within a VPC and creating a subnet group allows RDS to be launched in a private subnet, enhancing security and availability.

Question 5

A user is creating a PIOPS volume. What is the maximum ratio the user should configure between PIOPS and the volume size?

Accepted Answer

The answer of A user is creating a PIOPS volume....

Question 6

IAM Secure and Scalable is an organization which provides scalable and secure SAAS to its clients. They are planning to host a web server and App server on AWS VPC as separate tiers. The organization wants to implement the scalability by configuring Auto Scaling and load balancer with their app servers (middle tier) too. Which of the below mentioned options suits their requirements?

Accepted Answer

An Internal Load Balancer within a VPC is suitable for distributing traffic among app servers in a private network, ensuring scalability and security without exposing the app servers directly to the internet.

Question 7

In AWS, which security aspects are the customer's responsibility? (Choose 4)

Accepted Answer

The answer of In AWS, which security aspects are the...

Question 8

You've been brought in as solutions architect to assist an enterprise customer with their migration of an e-commerce platform to Amazon Virtual Private Cloud (VPC) The previous architect has already deployed a 3-tier VPC. The configuration is as follows: VPC: vpc-2f8bc447 IGW: igw-2d8bc445 NACL: ad-208bc448 Subnets and Route Tables: Web servers: subnet-258bc44d Application servers: subnet-248bc44c Database servers: subnet-9189c6f9 Route Tables: rrb-218bc449 rtb-238bc44b Associations: subnet-258bc44d : rtb-218bc449 subnet-248bc44c : rtb-238bc44b subnet-9189c6f9 : rtb-238bc44b You are now ready to begin deploying EC2 instances into the VPC  Web servers must have direct access to the internet Application and database servers cannot have direct access to the internet. Which configuration below will allow you the ability to remotely administer your application and database servers, as well as allow these servers to retrieve updates from the Internet?

Accepted Answer

Creating a bastion and NAT instance in the public subnet (subnet-258bc44d) allows secure remote administration and internet access for updates. The NAT instance enables private subnets to access the internet without direct exposure.

Question 9

A user is running a batch process on EBS backed EC2 instances. The batch process launches few EC2 instances to process Hadoop Map reduce jobs which can run between 50 ?600 minutes or sometimes for even more time. The user wants a configuration that can terminate the instance only when the process is completed. How can the user configure this with CloudWatch?

Accepted Answer

When the CPU utilization falls below a certain threshold (e.g., 5%), it can indicate that the batch process has completed, allowing CloudWatch to trigger an action to terminate the instance.

Question 10

When you resize the Amazon RDS DB instance, Amazon RDS will perform the upgrade during the next maintenance window. If you want the upgrade to be performed now, rather than waiting for the maintenance window, specify the option.

Accepted Answer

The correct option is "ApplyImmediately". When you want the changes to take effect immediately, you specify the "ApplyImmediately" option in Amazon RDS.

Question 11

A bucket owner has allowed another account's IAM users to upload or access objects in his bucket. The IAM user of Account A is trying to access an object created by the IAM user of account B. What will happen in this scenario?

Accepted Answer

AWS S3 will check if the bucket owner has granted the necessary permissions to the IAM user of Account A and if the IAM user of Account B has granted the necessary permissions to the object.

Question 12

In the context of IAM roles for Amazon EC2, which of the following NOT true about delegating permission to make API requests?

Accepted Answer

IAM roles can be created to delegate permissions for making API requests, so statement A is not true.

Question 13

Who is responsible for modifying the routing tables and networking ACLs in a VPC to ensure that a DB instance is reachable from other instances in the VPC?

Accepted Answer

The owner of the AWS account is responsible for configuring and modifying routing tables and networking ACLs in a VPC to ensure connectivity between instances, including DB instances.

Question 14

A government client needs you to set up secure cryptographic key storage for some of their extremely confidential data. You decide that the AWS CloudHSM is the best service for this. However, there seem to be a few pre-requisites before this can happen, one of those being a security group that has certain ports open. Which of the following is correct in regards to those security groups?

Accepted Answer

AWS CloudHSM requires a security group that allows inbound access on port 22 for SSH or port 3389 for RDP to manage the HSM instances.

Question 15

You want to define permissions for a role in an IAM policy. Which of the following configuration formats should you use?

Accepted Answer

IAM policies are defined using JSON documents written in the IAM Policy Language.

Question 16

With respect to AWS Lambda permissions model, at the time you create a Lambda function, you specify an IAM role that AWS Lambda can assume to execute your Lambda function on your behalf. This role is also referred to as the________role.

Accepted Answer

The IAM role specified for a Lambda function is referred to as the "execution role." This role grants the necessary permissions for the Lambda function to access AWS services and resources.

Question 17

"In the context of Amazon ElastiCache, from the application's point of view, connecting to the cluster configuration endpoint is no different than connecting directly to an individual cache node."

Accepted Answer

Connecting to the cluster configuration endpoint allows the application to access the cache cluster as a whole, similar to connecting to an individual cache node, but with the added benefit of automatic node discovery and failover management.

Question 18

In AWS IAM, which of the following predefined policy condition keys checks how long ago (in seconds) the MFA-validated security credentials making the request were issued using multi- factor authentication (MFA)?

Accepted Answer

The correct predefined policy condition key is "aws:MultiFactorAuthAge," which checks the age of the MFA-validated security credentials in seconds.

Question 19

IAM users do not have permission to create Temporary Security Credentials for federated users and roles by default. In contrast, IAM users can call __________ without the need of any special permissions

Accepted Answer

IAM users can call GetSessionToken without needing special permissions, as it is used to obtain temporary security credentials for the IAM user itself, not for federated users or roles.

Question 20

A user is configuring MySQL RDS with PIOPS. What should be the minimum PIOPS that the user should provision?

Accepted Answer

The minimum PIOPS (Provisioned IOPS) that a user should provision for MySQL RDS is 1000.

Exam 10: AWS Certified Solutions Architect - Professional (SAP-C01)