1. You have five CloudFormation templates; each template is for a different application architecture.

This architecture varies between your blog apps and your gaming apps. What determines the cost of
using the CloudFormation templates?
The time it takes to build the architecture with Cloud Formation.

Cloud Formation does not have any additional cost but you are charged for the underlying
resources it builds.

0.10$ per template per month

0.1$ per template per month

2. Which of the following correctly applies to changing the DB subnet group of your DB instance?
An existing DB Subnet group can be updated to add more subnets for existing Availability Zones.

An existing DB group cannot be updated to add more subnets for new Availability Zones.

Removing subnets from an existing DB subnet group can cause unavailability.

Updating an existing DB subnet group of a deployed DB instance is not currently allowed.

Explicitly changing the DB Subnet group of a deployed DB instance is not currently allowed.

3. If you want to use an SSL protocol but do not want to terminate the connection on your load
balancer, you can use a __________ protocol for connection from the client to your load balancer.
HTTP

TSL

HTTPS

TCP

4. If you want to build your own payments application, then you should take advantage of the
richness and flexibility of _____________.
PayPal Payment service

EBay Payment service

Amazon AWS DevPay

5. You are building an automated transcription service in which "Amazon EC2 worker" instances
process an uploaded audio file and generate a text file. You must store both of these files in the same
durable storage until the text file is retrieved, but you do not know what the storage capacity
requirements are. Which storage option is both cost-efficient and scalable?
Multiple Amazon EBS volume with snapshots

A single Amazon Glacier Vault

A single Amazon S3 bucket

Multiple instance stores

6. Which of the following should be referred to if you want to map Amazon Elastic Block Store to an
Amazon EC2 instance for AWS CloudFormation resources?
The logical IDs of the instance

Reference the logical IDs of both the block stores and the instance

Reference the physical IDs of the instance

Reference the physical IDs of the both the block stores and the instance

7. In the event of a planned or an unplanned outage of your primary DB instance, Amazon RDS
automatically switches to a standby replica in another Availability Zone if you have
enabled_________.
More than one read replica

More than one write replica

Multiple Availability Zones

Multi Region Deployment

8. Which of the following approaches provides the lowest cost for Amazon elastic block store
snapshots while giving you the ability to fully restore data?
Maintain two snapshots: the original snapshot and the latest incremental snapshot.
 Maintain a volume snapshot; subsequent snapshots will overwrite one another.

Maintain a single snapshot; the latest snapshot is both incremental and complete.

Maintain the most current snapshot; archive the original and increment to Amazon Glacier.

9. You try to connect via SSH to a newly created Amazon EC2 instance and get one of the following
error messages: 'Network error: connection timed out" or "Error connecting to [instance], reason :->
Connection timed out: connect,' you have confirmed that the network and security group rules are
configured correctly and the instance is passing status checks. What steps should you take to identify
the source of the behavior? (Select all that apply)
Verify that the private key file corresponds to the Amazon EC2 key pair assigned at launch.

Verify that your IAM user policy has permission to launch Amazon EC2 instances.

Verify that you are connecting with the appropriate user name for your AMI.

Verify that the Amazon EC2 instance was launched with the proper IAM role.

Verify that your federation trust to AWS has been established.

10. In a VPC network, access control lists (ACLs) act as a firewall for associated subnets, controlling
both inbound and outbound traffic at the __________ level.
Full VPC

Customer Gateway

EC2 instance

Subnet

11. Which of the following is NOT true about the local secondary index?
The key of a local secondary index consists of a hash key and a range key.

For each hash key, the total size of all indexed items must be 10 GB or less.

The local secondary index allows you query over the entire table, across all partitions.

When you query a local secondary index, you can choose either eventual consistency or strong
consistency.
12. A user has created multiple data points for the CloudWatch metrics with the dimensions,
Box=UAT, App = Document and Box = UAT, App = Notes. If the user queries CloudWatch with the
dimensions parameter as, Server=prod, what data will he get?
The last value of the email and sms metric

It will not return any data as the dimension for Box=UAT does not exist

All values specified for the dimension Box=UAT, App=Document

All values specified for the dimension Box=UAT, App=Notes

13. For Dynamo DB, which of the following statements are correct? (Select all that apply)
By using proxy, it is not possible for a developer to achieve item level access control.

By using FGAC, it is possible for a developer to achieve item level access control.

By using Per-Client Embedded Token, it is possible for a developer to achieve item level access
control.

By using secret key, it is possible for a developer to achieve item level access control.

14. You try to enable lifecycle policies on one of the S3 buckets created by you, but you are not able to
do so on that particular bucket. What could be the reason?
Bucket is corrupted.

Versioning is not enabled on that bucket.

Bucket type is not correct.

Versioning is enabled on the bucket.

15. Each EC2 instance has a default network interface that is assigned a primary private IP address on
your Amazon VPC network. What is the name given to the additional network interfaces that can be
created and attached to any Amazon EC2 instance in your VPC?
Elastic IP

Elastic Network Interface

AWS Elastic Interface

16. Which IAM policy condition key should be used if you want to check whether the request was sent
using SSL?
AWS: secure transport

AWS: secure IP

AWS: source IP

AWS: user agent

17. What does the following policy for Amazon EC2 do? { “Statement”: [{ “Effect”:”Allow”,
“Action”:”ec2: Describe*”, “Resource”:”*” }
Allow users to use all actions on an EC2 instance.

Allow users to use actions that start with 'Describe' across all the EC2 resources.

Allow users to use actions that does not have the keyword "Describe' across all the EC2 resources.

Allow a group to be able to Describe with run, stop, start, and terminate instances.

18. For what purpose is the string “create image" API action used?
To create an Amazon EBS-backed AMI from an Amazon EBS-backed instance that is either running
or has stopped

To initiate the copy of an AMI from the specified source region to the current region

To deregister the specified AMI. After you deregister an AMI, It can't be used to launch new
instances.

To describes one or more of the images (AMIS, AKIS, and ARIS) available to you

19. If you launch an instance into a VPC that has an instance tenancy of a ______________, your
instance is automatically a Dedicated Instance, regardless of the tenancy of the instance.
secured instance

dedicated instance
 default instance

new instance

20. In DynamoDB you can issue a scan request. By default, the scan operation processes data
sequentially. DynamoDB returns data to the application in _________ increments, and an application
performs additional scan operations to retrieve the next ___________ of data.
0, 1 MB

1, 10 MB

1, 1 MB

5, 5 MB

21. AWS requires ____________ when you need to specify a resource uniquely across all of AWS, such
as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls.
IAM Used Id

Account Id

IAM policy

Amazon Resource Names

22. ___________ is a task coordinator and state management service for cloud applications.
Amazon SWF

Amazon SNS

Amazon SQS

Amazon SES

23. Which of the following IP address mechanisms are supported by ELB?

IPv5
 IPv6

IPv3

24. A ___________ is a physical device or software application on your side of the VPN connection.
Customer gateway

Gateway level

Gateway table

Virtual private gateway

25. You are currently hosting multiple applications in a VPC and have logged numerous port scans
coming in from a specific IP address block. Your security team has requested that all access to the
offending IP address block be denied for the next 24 hours. Which of the following is the best method
to quickly and temporarily deny access to the specified IP address block?
Create an AD policy to modify Windows Firewall settings on all hosts in the VPC to deny access to
the IP address block.

Modify the Network ACLs (NACLs) associated with all public subnets in the VPC to deny access from
the IP address block.

Modify the Windows Firewall settings on all Amazon Machine Images (AMIs) which your
organization uses in that VPC to deny access from the IP address block.

26. Which ELB component is responsible for monitoring the Load Balancers?
Controller service

Load Balancer

Auto Scaling

Load Manager

27. Which disaster recovery method involves running your site in AWS and on your existing on-site
infrastructure in an active-active configuration?
Multi-site solution
 Active-passive solution

Pilot light

Warm standby solution

28. An application hosted at the EC2 instances receives HTTP requests through the ELB. Each request
has an X-Forwarded-For request header, having three IP addresses. Which of the following IP address
will be a part of this header?
IP address of ELB

IP address of Forward Request

IP address of client

IP address of CloudWatch

29. You have launched an instance in EC2-Classic and you want to make some change to the security
group rule. How will these changes be effective?
Security group rules cannot be changed.

Changes are automatically applied to all instances that are associated with the security group.

Changes will be effective after rebooting the instances in that security group.

Changes will be effective after 24-hours.

30. You have an application running on Amazon Web Services. The application has 4 EC2 instances in
Availability Zone us-east-1c. You're using Elastic Load Balancer to load balance traffic across your four
instances. What changes would you make to create a fault tolerant architecture?
Create EBS backups to ensure data is not lost.

Move all four instances to a different Availability Zone.

Move two instances to another Availability Zone.

Use CloudWatch to distribute the load evenly.

31. The load balancer does not distribute traffic across ________.
 One Availability Zone

Domains

Availability Zones within a region

Regions

32. In context of CloudFormation, which of the following information do you get from the AWS Cloud
Formation list-stacks Command?
A list of any of the stacks you have created.

A list of any of the stacks you have created or have deleted up to 90 days ago.

A list of any of the stacks that have been created or deleted up to 60 days ago.

A 90 days history list of all your activity on stacks

33. When you use the wizard in the console to create a VPC with a gateway, the wizard automatically
__________ to use the gateway.
updates the route tables

updates the IP tables

updates the protocol tables

updates the IP tables and the protocol tables

34. You've created production architecture on AWS. It consists of one load balancer, one route53
domain, two Amazon S3 buckets, Auto Scaling policy, and Amazon CloudFront for content delivery.
Your manager asks you to duplicate this architecture by using a JSON based template. Which of the
following AWS service would you use to achieve this?
Amazon DynamoDB

Amazon Simple DB

Amazon CloudFormation

Amazon Bootstrap
35. You have configured a website www.abc.com and hosted it on WebLogic Server and you are using
ELB with the EC2 instances for load balance. Which of the following would you configure to ensure
that the EC2 instances accept requests only from ELB?
Configure the security group of EC2, which allows access to the ELB source security group.

Configure the EC2 instance so that it only listens on the ELB port.

Configure the security group of EC2, which allows access only to the ELB listener.

Open the port for an ELB static IP in the EC2 security group.

36. You have written a CloudFormation template that creates one Elastic Load Balancer fronting two
EC2 instances. Which section of the template should you edit so that the DNS of the load balancer is
returned upon creation of the stack?
Outputs

Resources

Parameters

Mappings

37. What does a 'Domain" refer to in Amazon SWF?

A Security group in which internal tasks can communicate with each other

A collection of related Workflows

A collection of related topics

38. A customer has a website which is accessible over the Internet and he wants to secure the
communication and decides to implement HTTPS instead of HTTP. He has configured EC2 instance
behind an ELB. Where should you configure the SSL certificate?
Not possible in AWS

SSL certificate will be installed at ELB and the listener port should be changed from 80 to 443 to
allow the traffic to reach EC2
 SSL certificate will be installed at EC2 and listener port should be changed from 80 to 443

SSL certificate will be installed at EC2 and listener port can remain at 443

39. Once you've successfully created a Microsoft windows stack on AWS CloudFormation, you can log
in to your instance with _______ to configure it manually.
AWS Command Line Interface

Remote Desktop

Power shell

Windows Command prompt

40. You have created a custom configured Amazon instance using Linux, containing all your software
and applications. If you want to use the same setup again, what is the best way to do it?
Create a back up copy of the EBS service

Create a backup of the EC2 instances only

Create a snapshot of the AMI only

Create an EBS Image (AMI)

41. With regards to VPC, what is the default maximum number of virtual private gateways allowed
per region?
10

15

42. Elasticity is a fundamental property of the cloud. Which of the following best describes elasticity?
The power to scale computing resources up and down easily with minimal friction

Ability to create services without having to administer resources

Power to scale computing resources up easily but not scale down.

43. With regards to RDS, the standby should be in the same ______________ as the primary instance.
Availability Zone

Region

VPC

Subnet

44. AWS Identity and Access Management is available through which of the following interfaces?
AWS Management Console

Command line interface (CLI)

IAM QUERY API

Elastic Load Balancer

Cloud Formation

45. Scalability is a fundamental property of a good AWS system. Which of the following best describes
scalability on AWS?
Scalability is the concept of planning ahead for what maximum resources will be required and
building your infrastructure based on that capacity plan.

The law of diminishing returns will apply to resources as they are increased with workload.

Increasing resources result in a proportional increase in performance.

Scalability is not a fundamental property of the cloud.

46. Which technique can be used to integrate AWS IAM (Identity and Access Management) with an
on-premises LDAP (Light Weight Directory Access Protocol) directory service?
Use an IAM policy that references the LDAP account identifiers and the AWS credentials.
 Use SAML (Security Assertion Markup Language) to enable single sign-on between AWS and LDAP.

Use AWS security Token Service from an identity broker to issue short-lived AWS credentials.

Use IAM roles to automatically rotate the IAM credentials when LDAP credentials are updated.

Use the LDAP credentials to restrict a group of users from launching specific EC2 instance types.

47. If you are using a non-transactional engine such as My ISAM, which of the following steps need to
be performed to successfully set up your Read Replica so it has a consistent copy of your data?
Stop all DML and DDL operations on non-transactional tables and wait for them to complete

Flush and lock those tables

Create the Read Replica using the Create DB instance Read Replica API

Check the progress of the Replica creation using the describe DB instances API

Set AWS IAM and KMS

48. In CloudFront, if you add a CNAME for www.abc.com to your distribution, you also need to create
(or update) a CNAME record with your DNS service to route queries for ___________.
www.abc.comto d111111abcdef8.cloudfront.com

d111111abcdef8.cloudfront.com to www.abc.com

www.abc.com to d111111abcdef8.cloudfront.net

d111111abcdef8.cloudfront.net to www.abc.com

49. Your manager has asked you to build a MongoDB replica set in the Cloud. Amazon Web Services
does not provide a MongoDB service. How would you go about setting up the MongoDB replica set?
You have to build it on another data center.

Request AWS to add a Mongo DB service.

Build the replica set using EC2 instances and manage the Mongo DB instances yourself.

It is not possible to do it.

Amazon RDS

Simple DB

DynamoDB

51. How many requests per second can Amazon CloudFront handle?
10,000

100

1000

500

52. When you need to use CloudFront to distribute your content you need to create a distribution.
You also need to specify the configuration settings. Which of the following configuration settings
would you specify?
You can configure the environment variables.

You can specify the number of files that you can serve per distribution.

You can specify whether you want the files to be available to everyone or you want to restrict
access to selected users.

You can specify your origin Amazon S3 bucket or HTTP server.

53. You currently operate a web application in the AWS US-East region. The application runs on an
auto-scaled layer of EC2 instances and an RDS Multi-AZ database. Your IT security compliance officer
has tasked you to develop a reliable and durable logging solution to track changes made to your EC2,
IAM, and RDS resources. The solution must ensure the integrity and confidentiality of your log data.
Which of these solutions would you recommend?
 Create a new Cloud Trail with one new S3 bucket to store the logs and with the global services
option selected. Use IAM roles S3 bucket policies and Multi Factor Authentication (MFA) delete on the
S3 bucket that stores your logs.

Create a new Cloud Trail with one new S3 bucket to store the logs. Configure SNS to send log file
delivery notifications to your management system. Use IAM roles and S3 bucket policies on the S3
bucket that stores your logs.

Create a new Cloud Trail with an existing S3 bucket to store the logs and with the global services
option selected. Use S3 ACLs and Multi Factor Authentication (MFA) delete on the S3 bucket that stores
your logs.

Create three new Cloud trails with three new S3 buckets to store the logs-one for the AWS
management console, one for AWS SDKs ,and one for command line tools. Use IAM roles and S3 bucket
policies on the S3 buckets that store your logs.

54. Which of the following metrics can have a CloudWatch Alarm?

EC2 instance status Check Failed

EC2 CPU utilization

Auto Scaling group CPU utilization

55. Which of the following payment options are associated with Reserved Instances?
Partial Upfront

No Upfront

Annual Upfront

All Upfront

56. You have a website www.abc.com which is used quite frequently. Therefore, you decide to use 50
EC2 instances, with two availability zones in two regions, each with 25 instances. However, while
starting the servers, you are able to start only 20 servers and then the requests start failing. Why?
There is a limit of 20 EC2 instances in each region; you can request to increase the limit.

There is a limit of 20 EC2 instances in each availability zone, you can request to increase the limit.
 You might have exhausted the free space available and need to select paid version of storage.

You cannot have more than one availability zone in a region.

57. www.picsee.com website has millions of photos and also thumbnails for each photo. Thumbnails
can easily be reproduced from the actual photo. However, a thumbnail takes less space than actual
photo. Which of the following is the best solution to store thumbnails?
S3

Reduced Redundancy Storage

DynamoDB

Elastic Cache

Amazon Glacier

58. You want your Hadoop job to be triggered based on the event notification of a file upload action.
Which of the following components can help you implement this in AWS?
S3

SQS

SNS

EC2

IAM

59. www.dropbag.com is a website where you have file sharing and storing services like Google Drive
and Google Dropbox. During the sync up from desktop you accidently deleted an important file.
Which of the simple storage service will help you retrieve the deleted file?
Versioning in S3

Secured signed URLs for S3 data access

Don't allow delete objects from S3 (only soft delete is permitted)

60. www.picnic.com is a photo and video hosting website and they have millions of users. Which of
the following is a good solution for storing big data object, by reducing costs, scaling to meet demand,
and increasing the speed of innovation?
AWS S3

AWS RDS

AWS Glaciers

AWS Redshift