AWS Certified Solutions Architect – Professional SAP-C01 – Question179

A user is trying to create a vault in AWS Glacier. The user wants to enable notifications.
In which of the below mentioned options can the user enable the notifications from the AWS console?

A.
Glacier does not support the AWS console
B. Archival Upload Complete
C. Vault Upload Job Complete
D. Vault Inventory Retrieval Job Complete

Correct Answer: D

Explanation:

Explanation: From AWS console the user can configure to have notifications sent to Amazon Simple Notifications Service (SNS). The user can select specific jobs that, on completion, will trigger the notifications such as Vault Inventory Retrieval Job Complete and Archive Retrieval Job Complete.
Reference:
http://docs.aws.amazon.com/amazonglacier/latest/dev/configuring-not…

AWS Certified Solutions Architect – Professional SAP-C01 – Question178

An organization is planning to setup a management network on the AWS VPC. The organization is trying to secure the webserver on a single VPC instance such that it allows the internet traffic as well as the back-end management traffic. The organization wants to make so that the back end management network interface can receive the SSH traffic only from a selected IP range, while the internet facing webserver will have an IP address which can receive traffic from all the internet IPs.
How can the organization achieve this by running web server on a single instance?

A.
It is not possible to have two IP addresses for a single instance.
B. The organization should create two network interfaces with the same subnet and security group to assign separate IPs to each network interface.
C. The organization should create two network interfaces with separate subnets so one instance can have two subnets and the respective security groups for controlled access.
D. The organization should launch an instance with two separate subnets using the same network interface which allows to have a separate CIDR as well as security groups.

Correct Answer: C

Explanation:

Explanation: A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account. It enables the user to launch AWS resources into a virtual network that the user has defined. An Elastic Network Interface (ENI) is a virtual network interface that the user can attach to an instance in a VPC. The user can create a management network using two separate network interfaces.
For the present scenario it is required that the secondary network interface on the instance handles the public facing traffic and the primary network interface handles the back-end management traffic and it is connected to a separate subnet in the VPC that has more restrictive access controls.
The public facing interface, which may or may not be behind a load balancer, has an associated security group to allow access to the server from the internet while the private facing interface has an associated security group allowing SSH access only from an allowed range of IP addresses either within the VPC or from the internet, a private subnet within the VPC or a virtual private gateway.
Reference:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

AWS Certified Solutions Architect – Professional SAP-C01 – Question177

A user is planning to use EBS for his DB requirement. The user already has an EC2 instance running in the VPC private subnet. How can the user attach the EBS volume to a running instance?

A.
The user can create EBS in the same zone as the subnet of instance and attach that EBS to instance.
B. It is not possible to attach an EBS to an instance running in VPC until the instance is stopped.
C. The user can specify the same subnet while creating EBS and then attach it to a running instance.
D. The user must create EBS within the same VPC and then attach it to a running instance.

Correct Answer: A

Explanation:

Explanation: A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account. The user can create subnets as per the requirement within a VPC. The VPC is always specific to a region. The user can create a VPC which can span multiple Availability Zones by adding one or more subnets in each Availability Zone. The instance launched will always be in the same availability zone of the respective subnet. When creating an EBS the user cannot specify the subnet or VPC. However, the user must create the EBS in the same zone as the instance so that it can attach the EBS volume to the running instance.
Reference:
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.h…

AWS Certified Solutions Architect – Professional SAP-C01 – Question176

The user has provisioned the PIOPS volume with an EBS optimized instance. Generally speaking, in which I/O chunk should the bandwidth experienced by the user be measured by AWS?

A.
128 KB
B. 256 KB
C. 64 KB
D. 32 KB

Correct Answer: B

Explanation:

Explanation: IOPS are input/output operations per second. Amazon EBS measures each I/O operation per second (that is 256 KB or smaller) as one IOPS.
Reference:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-character…

AWS Certified Solutions Architect – Professional SAP-C01 – Question175

An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords.
How can the organization achieve this?

A.
The organization should create each user in a separate region so that they have their own URL to login
B. The organization should create a separate login ID but give the IAM users the same alias so that each one can login with their alias
C. It is not possible to have the same login ID for multiple IAM users of the same account
D. The organization should create various groups and add each user with the same login ID to different groups. The user can login with their own group ID

Correct Answer: C

Explanation:

Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. Whenever the organization is creating an IAM user, there should be a unique ID for each user. It is not possible to have the same login ID for multiple users. The names of users, groups, roles, instance profiles must be alphanumeric, including the following common characters: plus (+), equal (=), comma (,), period (.), at (@), and dash (-).
Reference:
http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_SettingUpUser…

AWS Certified Solutions Architect – Professional SAP-C01 – Question174

In Amazon VPC, what is the default maximum number of BGP advertised routes allowed per route table?

A.
15
B. 100
C. 5
D. 10

Correct Answer: B

Explanation:

Explanation: The maximum number of BGP advertised routes allowed per route table is 100.
Reference:
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_…

AWS Certified Solutions Architect – Professional SAP-C01 – Question173

The CFO of a company wants to allow one of his employees to view only the AWS usage report page.
Which of the below mentioned IAM policy statements allows the user to have access to the AWS usage report page?

A.
"Effect": "Allow", "Action": ["Describe"], "Resource": "Billing"
B. "Effect": "Allow", "Action": ["aws-portal: ViewBilling"], "Resource": "*"
C. "Effect": "Allow", "Action": ["aws-portal: ViewUsage"], "Resource": "*"
D. "Effect": "Allow", "Action": ["AccountUsage], "Resource": "*"

Correct Answer: C

Explanation:

Explanation: AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. If the CFO wants to allow only AWS usage report page access, the policy for that IAM user will be as given below:
{
“Version”: “2012-10-17”,
“Statement”:
[ {
“Effect”: “Allow”,
“Action”: [ “aws-portal:ViewUsage” ],
“Resource”: “*”
} ]
}
Reference:
http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing…

AWS Certified Solutions Architect – Professional SAP-C01 – Question172

In IAM, which of the following is true of temporary security credentials?

A.
Once you issue temporary security credentials, they cannot be revoked.
B. None of these are correct.
C. Once you issue temporary security credentials, they can be revoked only when the virtual MFA device is used.
D. Once you issue temporary security credentials, they can be revoked.

Correct Answer: A

Explanation:

Explanation: Temporary credentials in IAM are valid throughout their defined duration of time and hence can’t be revoked. However, because permissions are evaluated each time an AWS request is made using the credentials, you can achieve the effect of revoking the credentials by changing the permissions for the credentials even after they have been issued.
Reference:
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp…

AWS Certified Solutions Architect – Professional SAP-C01 – Question171

What types of identities do Amazon Cognito identity pools support?

A.
They support both authenticated and unauthenticated identities.
B. They support only unauthenticated identities.
C. They support neither authenticated nor unauthenticated identities.
D. They support only authenticated identities.

Correct Answer: A

Explanation:

Explanation: Amazon Cognito identity pools support both authenticated and unauthenticated identities. Authenticated identities belong to users who are authenticated by a public login provider or your own backend authentication process. Unauthenticated identities typically belong to guest users.
Reference: http://docs.aws.amazon.com/cognito/devguide/identity/identity-pools/

AWS Certified Solutions Architect – Professional SAP-C01 – Question170

What feature of the load balancing service attempts to force subsequent connections to a service to be redirected to the same node as long as it is online?

A.
Node balance
B. Session retention
C. Session multiplexing
D. Session persistence

Correct Answer: D

Explanation:

Explanation: Session persistence is a feature of the load balancing service. It attempts to force subsequent connections to a service to be
redirected to the same node as long as it is online.
Reference: http://docs.rackspace.com/loadbalancers/api/v1.0/clb-devguide/conte…