AISS - AWS SA - AWS_Pillars

^{(from linux academy - Operation Exellence Pillar)}

You business operates in a very secure sensitive industry. You are looking at how to secure a small VPC. Your environment consists of a single S3 bucket, and an EC2 instance running in a internet connected VPC. What is the best way to lock down the environment, allowing access to S3 but keeping the environment as secure as possible?

• Create an S3 VPC endpoint. Apply a policy restricting access to the S3 bucket from the VPC endpoint.

• Create an S3 VPC endpoint. Apply a policy restricting access to the S3 bucket from the VPC endpoint, and remove the internet gateway. Setup a VPN Endpoint and client to securely SSH into the EC2 instance when needed.

• Provision a privately addressable S3 bucket in your VPC. Migrate the contents of the public bucket and update the application. Remove the internet gateway to isolate the VPC.

• Create a new security group, denying all IP's except the EC2 instance, and associate it with the S3 bucket.

^{(from linux academy - Operation Exellence Pillar)}

Your existing custom NACL currently allows all Internet web traffic into the subnet. As part of a project implementation, you need to block IP traffic from a subnet to a specific internet IP address. How can this be accomplished?

• Create a Security group, add a DENY rule to it, and attach to the subnet.

• Attach a NACL to the subnet and add a DENY rule to it.

• Attach a NACL to the VPC and add a DENY rule.

• Create a Security group, add a DENY rule, and attach it to any resources in the subnet which need the DENY rule applied.

^{(from linux academy - Operation Exellence Pillar)}

Which of the following events can be logged using CloudTrail. (Choose all that apply)

• CLI Calls to the AWS Account

• API Calls to the AWS Account

• SSH Connections to EC2 Instances

• Operations on S3 Objects

^{(from linux academy - Operation Exellence Pillar)}

You need to migrate a legacy application into AWS. It currently runs on a Linux operating system and has a requirement for iSCSI based block storage. Which AWS Service would you utilise to meet this requirement?

• EFS

• S3

• Storage Gateway

• EBS

^{(from linux academy - Operation Exellence Pillar)}

Which of the following are AWS managed services that can allow host access to instances running on the respective services? (Choose all that apply)

• DynamoDB

• Amazon EC2

• Amazon RDS

• Amazon EMR

• ElastiCache

^{(from linux academy - Operation Exellence Pillar)}

You are designing a VPC to host a small application. The VPC will be connected back to your on-premises network using a VPN. An EC2 instance runs the application, and will only need to connect to the internet for software updates. You have a list of the software update DNS names. How can you restrict this within the AWS VPC?

• Place the EC2 instance in a public subnet and add an internet gateway.

• This restriction isn't possible using an AWS VPC.

• Add an internet gateway to the VPC, and a proxy service running on a EC2 instance in a public subnet with an elastic IP.

• Use the DNS filtering option on a NAT gateway to restrict internet access to just the software updates.

^{(from linux academy - Operation Exellence Pillar)}

You've been asked to host a docker container within your AWS environment. What is the most appropriate product to use for this task?

• Lambda

• EC2

• Opsworks

• ECS

^{(from linux academy - Operation Exellence Pillar)}

You are designing a VPC for a small application. It will operate in a private subnet and needs internet access to software updates and other communications with internet IPs. Your security team is happy that there are no restrictions in the application server's internet access. Which AWS products are needed to allow this solution. The priority is using the least amount of services. Assume the EC2 instance and any NACL's, routes, and Security groups are included implicitly.

• VPC, Subnets, Route Table(s), Nat Gateway, and Internet Gateway.

• VPC, Subnets, Route Tables, VPC Peering, and Virtual Private Gateway

• VPC, Subnets, Route Table(s), and NAT Gateway

• VPC, Subnets, Route Table(s), and Internet Gateway

^{(from linux academy - Operation Exellence Pillar)}

Which of the following AWS storage services are able to be natively mounted as mount points on a Linux system.

• EBS and Instance Store only

• Glacier, Instance Store, and EBS

• Instance Store, EBS, and EFS

• Instance Store, EBS, S3, Glacier, and EFS

^{(from linux academy - Operation Exellence Pillar)}

You run a single instance application on an EC2 instance in AWS. Your architecture teams are looking to make changes and convert the application to operate on multiple servers. The app runs on Linux and currently accesses millions of flat file data files in the /data/... folder structure. This database is stored on an EBS volume attached to the EC2 instance. How can this be moved to work on multiple servers, with as little application changes as possible? What product would you suggest?

• EFS

• Use EBS to mount the existing volume on all the new instances.

• S3

• EMR and HDFS