Question 1

An organization has developed an application which provides a smarter shopping experience. They need to show a demonstration to various stakeholders who may not be able to access the in premise application so they decide to host a demo version of the application on AWS. Consequently, they will need a fixed elastic IP attached automatically to the instance when it is launched. In this scenario which of the below mentioned options will not help assign the elastic IP automatically?
A) Write a script which will fetch the instance metadata on system boot and assign the public IP using that metadata.
B) Provide an elastic IP in the user data and setup a bootstrapping script which will fetch that elastic IP and assign it to the instance.
C) Create a controlling application which launches the instance and assigns the elastic IP based on the parameter provided when that instance is booted.
D) Launch instance with VPC and assign an elastic IP to the primary network interface.

Accepted Answer

The script in option A fetches the instance metadata to assign a public IP, but it does not automatically assign an elastic IP, which is a static IP address that needs to be explicitly allocated and associated with the instance.

Question 2

An organization is setting up RDS for their applications. The organization wants to secure RDS access with VPC. Which of the following options is not required while designing the RDS with VPC?
A) The organization must create a subnet group with public and private subnets. Both the subnets can be in the same or separate AZ.
B) The organization should keep minimum of one IP address in each subnet reserved for RDS failover.
C) If the organization is connecting RDS from the internet it must enable the VPC attributes DNS hostnames and DNS resolution.
D) The organization must create a subnet group with VPC using more than one subnet which are a part of separate AZs.

Accepted Answer

A subnet group with both public and private subnets is not required. RDS instances can be launched in private subnets only, and they do not need to be in both public and private subnets.

Question 3

In Amazon Cognito what is a silent push notification?
A) It is a push message that is received by your application on a user's device that will not be seen by the user.
B) It is a push message that is received by your application on a user's device that will return the user's geolocation.
C) It is a push message that is received by your application on a user's device that will not be heard by the user.
D) It is a push message that is received by your application on a user's device that will return the user's authentication credentials.

Accepted Answer

A silent push notification is designed to be received by the application without alerting the user, allowing the app to perform background tasks.

Question 4

Can a Direct Connect link be connected directly to the Internet?
A) Yes, this can be done if you pay for it.
B) Yes, this can be done only for certain regions.
C) Yes
D) No

Accepted Answer

Direct Connect is a dedicated network connection to AWS services, not to the Internet. It is used to connect on-premises networks to AWS, not for direct Internet access.

Question 5

Attempts, one of the three types of items associated with the schedule pipeline in the AWS Data Pipeline, provides robust data management. Which of the following statements is NOT true about Attempts?
A) Attempts provide robust data management.
B) AWS Data Pipeline retries a failed operation until the count of retries reaches the maximum number of allowed retry attempts.
C) An AWS Data Pipeline Attempt object compiles the pipeline components to create a set of actionable instances.
D) AWS Data Pipeline Attempt objects track the various attempts, results, and failure reasons if applicable.

Accepted Answer

An AWS Data Pipeline Attempt object does not compile pipeline components; it tracks attempts, results, and failure reasons.

Question 6

Which of the following is true of an instance profile when an IAM role is created using the console?
A) The instance profile uses a different name.
B) The console gives the instance profile the same name as the role it corresponds to.
C) The instance profile should be created manually by a user.
D) The console creates the role and instance profile as separate actions.

Accepted Answer

When an IAM role is created using the console, the instance profile is automatically created with the same name as the role.

Question 7

AWS Direct Connect itself has NO specific resources for you to control access to. Therefore, there are no AWS Direct Connect Amazon Resource Names (ARNs) for you to use in an Identity and Access Management (IAM) policy. With that in mind, how is it possible to write a policy to control access to AWS Direct Connect actions?
A) You can leave the resource name field blank.
B) You can choose the name of the AWS Direct Connection as the resource.
C) You can use an asterisk (*) as the resource.
D) You can create a name for the resource.

Accepted Answer

You can use an asterisk (*) as the resource in IAM policies to specify all resources, which is necessary when there are no specific ARNs available for AWS Direct Connect.

Question 8

Identify a true statement about using an IAM role to grant permissions to applications running on Amazon EC2 instances.
A) When AWS credentials are rotated; developers have to update only the root Amazon EC2 instance that uses their credentials.
B) When AWS credentials are rotated, developers have to update only the Amazon EC2 instance on which the password policy was applied and which uses their credentials.
C) When AWS credentials are rotated, you don't have to manage credentials and you don't have to worry about long-term security risks.
D) When AWS credentials are rotated, you must manage credentials and you should consider precautions for long-term security risks.

Accepted Answer

IAM roles provide temporary security credentials that are automatically rotated, eliminating the need for developers to manage credentials and reducing long-term security risks.

Question 9

You create a VPN connection, and your VPN device supports Border Gateway Protocol (BGP). Which of the following should be specified to configure the VPN connection?
A) Classless routing
B) Classfull routing
C) Dynamic routing
D) Static routing

Accepted Answer

BGP is a dynamic routing protocol used to exchange routing information between different networks, making dynamic routing the correct choice.

Question 10

When using string conditions within IAM, short versions of the available comparators can be used instead of the more verbose ones. streqi is the short version of the _______ string condition.
A) StringEqualsIgnoreCase
B) StringNotEqualsIgnoreCase
C) StringLikeStringEquals
D) StringNotEquals

Accepted Answer

The short version "streqi" corresponds to the IAM condition "StringEqualsIgnoreCase".

Question 11

A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 in this VPC. The user is trying to create another subnet with the same VPC for CIDR 20.0.0.1/24. What will happen in this scenario?
A) The VPC will modify the first subnet CIDR automatically to allow the second subnet IP range
B) The second subnet will be created
C) It will throw a CIDR overlaps error
D) It is not possible to create a subnet with the same CIDR as VPC

Accepted Answer

The second subnet cannot be created because its CIDR 20.0.0.1/24 overlaps with the existing subnet's CIDR 20.0.0.0/16, which covers the entire VPC range.

Question 12

ABC has created a multi-tenant Learning Management System (LMS). The application is hosted for five different tenants (clients) in the VPCs of the respective AWS accounts of the tenant. ABC wants to setup a centralized server which can connect with the LMS of each tenant upgrade if required. ABC also wants to ensure that one tenant VPC should not be able to connect to the other tenant VPC for security reasons. How can ABC setup this scenario?
A) ABC has to setup one centralized VPC which will peer in to all the other VPCs of the tenants.
B) ABC should setup VPC peering with all the VPCs peering each other but block the IPs from CIDR of the tenant VPCs to deny them.
C) ABC should setup all the VPCs with the same CIDR but have a centralized VPC. This way only the centralized VPC can talk to the other VPCs using VPC peering.
D) ABC should setup all the VPCs meshed together with VPC peering for all VPCs.

Accepted Answer

Setting up a centralized VPC that peers with each tenant's VPC allows the centralized server to connect to each LMS while maintaining isolation between tenant VPCs, as VPC peering is not transitive.

Question 13

In the context of policies and permissions in AWS IAM, the Condition element is ____________.
A) crucial while writing the IAM policies
B) an optional element
C) always set to null
D) a mandatory element

Accepted Answer

The Condition element in AWS IAM policies is optional and is used to specify conditions under which the policy is in effect.

Question 14

In the context of Amazon ElastiCache CLI, which of the following commands can you use to view all ElastiCache instance events for the past 24 hours?
A) elasticache-events --duration 24
B) elasticache-events --duration 1440
C) elasticache-describe-events --duration 24
D) elasticache describe-events --source-type cache-cluster --duration 1440

Accepted Answer

The correct command is "elasticache describe-events --source-type cache-cluster --duration 1440" because it uses the correct syntax for the AWS CLI and specifies the duration in minutes (1440 minutes equals 24 hours).

Question 15

What happens when Dedicated instances are launched into a VPC?
A) If you launch an instance into a VPC that has an instance tenancy of dedicated, you must manually create a Dedicated instance.
B) If you launch an instance into a VPC that has an instance tenancy of dedicated, your instance is created as a Dedicated instance, only based on the tenancy of the instance.
C) If you launch an instance into a VPC that has an instance tenancy of dedicated, your instance is automatically a Dedicated instance, regardless of the tenancy of the instance.
D) None of these are true.

Accepted Answer

When you launch an instance into a VPC with a dedicated instance tenancy, it is automatically created as a Dedicated instance, regardless of the tenancy setting of the instance itself.

Question 16

Identify an application that polls AWS Data Pipeline for tasks and then performs those tasks.
A) A task executor
B) A task deployer
C) A task runner
D) A task optimizer

Accepted Answer

A task runner is an application that polls AWS Data Pipeline for tasks and then performs those tasks.

Question 17

AWS has launched T2 instances which come with CPU usage credit. An organization has a requirement which keeps an instance running for 24 hours. However, the organization has high usage only during 11 AM to 12 PM. The organization is planning to use a T2 small instance for this purpose. If the organization already has multiple instances running since Jan 2012, which of the below mentioned options should the organization implement while launching a T2 instance?
A) The organization must migrate to the EC2-VPC platform first before launching a T2 instance.
B) While launching a T2 instance the organization must create a new AWS account as this account does not have the EC2-VPC platform.
C) Create a VPC and launch a T2 instance as part of one of the subnets of that VPC.
D) While launching a T2 instance the organization must select EC2-VPC as the platform.

Accepted Answer

T2 instances can only be launched in a VPC.

Question 18

Out of the striping options available for the EBS volumes, which one has the following disadvantage: 'Doubles the amount of I/O required from the instance to EBS compared to RAID 0, because you're mirroring all writes to a pair of volumes, limiting how much you can stripe.'?
A) Raid 1
B) Raid 0
C) RAID 1+0 (RAID 10)
D) Raid 2

Accepted Answer

The answer of Out of the striping options available for...

Question 19

An organization is having a VPC for the HR department, and another VPC for the Admin department. The HR department requires access to all the instances running in the Admin VPC while the Admin department requires access to all the resources in the HR department. How can the organization setup this scenario?
A) Setup VPC peering between the VPCs of Admin and HR.
B) Setup ACL with both VPCs which will allow traffic from the CIDR of the other VPC.
C) Setup the security group with each VPC which allows traffic from the CIDR of another VPC.
D) It is not possible to connect resources of one VPC from another VPC.

Accepted Answer

VPC peering allows instances in one VPC to communicate with instances in another VPC as if they are within the same network, enabling access between the HR and Admin VPCs.

Question 20

Within an IAM policy, can you add an IfExists condition at the end of a Null condition?
A) Yes, you can add an IfExists condition at the end of a Null condition but not in all Regions.
B) Yes, you can add an IfExists condition at the end of a Null condition depending on the condition.
C) No, you cannot add an IfExists condition at the end of a Null condition.
D) Yes, you can add an IfExists condition at the end of a Null condition.

Accepted Answer

IAM policies do not support combining IfExists with Null conditions. IfExists is used to check if a key exists, while Null checks if a key's value is null. They are separate condition operators.

Exam 10: AWS Certified Solutions Architect - Professional (SAP-C01)

An organization is setting up RDS for their applications. The organization wants to secure RDS access with VPC. Which of the following options is not required while designing the RDS with VPC?

In Amazon Cognito what is a silent push notification?

Can a Direct Connect link be connected directly to the Internet?

Attempts, one of the three types of items associated with the schedule pipeline in the AWS Data Pipeline, provides robust data management. Which of the following statements is NOT true about Attempts?

Which of the following is true of an instance profile when an IAM role is created using the console?

Identify a true statement about using an IAM role to grant permissions to applications running on Amazon EC2 instances.

You create a VPN connection, and your VPN device supports Border Gateway Protocol (BGP) . Which of the following should be specified to configure the VPN connection?

When using string conditions within IAM, short versions of the available comparators can be used instead of the more verbose ones. streqi is the short version of the _______ string condition.

A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 in this VPC. The user is trying to create another subnet with the same VPC for CIDR 20.0.0.1/24. What will happen in this scenario?

In the context of policies and permissions in AWS IAM, the Condition element is ____________.

In the context of Amazon ElastiCache CLI, which of the following commands can you use to view all ElastiCache instance events for the past 24 hours?

What happens when Dedicated instances are launched into a VPC?

Identify an application that polls AWS Data Pipeline for tasks and then performs those tasks.

Out of the striping options available for the EBS volumes, which one has the following disadvantage: 'Doubles the amount of I/O required from the instance to EBS compared to RAID 0, because you're mirroring all writes to a pair of volumes, limiting how much you can stripe.'?

Within an IAM policy, can you add an IfExists condition at the end of a Null condition?