AWS Q04

Which architecture concept describes the ability to deploy resources on demand and release resources when they are no longer needed?

• A. High availability

• B. Decoupled architecture

• C. Resilience

• D. Elasticity

Answer explanation

The correct answer is D. Elasticity.

Elasticity is an architecture concept that refers to the ability to automatically and quickly scale resources up or down based on demand. It allows applications to handle increases and decreases in workload by seamlessly adding or removing resources, such as compute capacity, storage, and network bandwidth, without any impact on performance. This is achieved by using features such as auto scaling, which automatically adjusts the number of resources based on demand, and elastic load balancing, which distributes incoming traffic across multiple resources to optimize performance and availability. Elasticity is a key characteristic of cloud computing that enables organizations to achieve cost savings and operational efficiency by paying only for the resources they use, and avoiding overprovisioning or underutilization of resources.

A company is required lo store its data close to its primary users. Which benefit of the AWS Cloud supports this requirement?

• A. Security

• B. High availability

• C. Elasticity

• D. Global footprint

Answer explanation

The correct answer is D. Global footprint. One of the benefits of the AWS Cloud is that it has a global infrastructure that allows companies to deploy their resources in regions closest to their primary users. This helps to reduce latency and improve the performance of their applications or services. AWS currently has over 80 Availability Zones in 25 geographic regions around the world, with more regions and zones planned for the future.

A security engineer wants a single-tenant AWS solution to create, control, and manage their own cryptographic keys to meet regulatory compliance requirements for data security. Which AWS service should the engineer use?

• A. AWS Key Management Service (AWS KMS)

• B. AWS Certificate Manager (ACM)

• C. AWS CloudHSM

• D. AWS Systems Manager

Answer explanation

The correct answer is C. AWS CloudHSM.

AWS CloudHSM is a single-tenant hardware appliance that provides secure key storage and management. It enables users to generate, store, and manage cryptographic keys used for data encryption within their own dedicated hardware security module (HSM). CloudHSM provides a level of control over the entire lifecycle of the keys, including generation, storage, usage, and destruction. This level of control can help meet regulatory compliance requirements for data security.

AWS trusted advisor can monitor and provide advice on what characteristics of an AWS account?

• A. Compliance with security best practices

• B. Application performance

• C. Network utilization

• D. Cost optimization

• E. Compliance status

Answer explanation

The correct answer is D. Cost optimization.

AWS Trusted Advisor is a service that inspects AWS environments and provides guidance in accordance with AWS best practices in five categories, including cost optimization, performance, security, fault tolerance, and service limits. So, AWS Trusted Advisor can monitor and provide advice on cost optimization characteristics of an AWS account.

When comparing AWS cloud with premises total cost of ownership which expenses must be considered?

• A. Physical storage hardware

• B. Operating system administration

• C. Network infrastructure of data center

• D. Project management

• E. Database schema development

Answer explanation

When comparing AWS cloud with on-premises total cost of ownership, the following expenses must be considered:

Physical storage hardware

Operating system administration

Network infrastructure of data center

Project management

Database schema development

Power and cooling costs

Data center space costs

Disaster recovery and business continuity costs

Hardware maintenance and upgrades

Security costs, such as firewalls and intrusion detection systems.

By moving to the AWS Cloud, many of these expenses are reduced or eliminated, as AWS provides managed services that handle the underlying infrastructure, such as servers, storage, and networking, as well as other services such as security, database management, and disaster recovery.

Which AWS service does AWS Snowball Edge natively support?

• A. AWS Server Migration Service (AWS SMS)

• B. Amazon Aurora

• C. AWS Trusted Advisor

• D. Amazon EC2

Answer explanation

AWS Snowball Edge natively supports Amazon EC2.

Amazon S3: Allows for the transfer of large amounts of data to and from Amazon S3 buckets.

Amazon EC2: Provides on-premises compute capacity and can be used to run applications and workloads locally.

AWS Lambda: Allows for the execution of code on Snowball Edge devices.

AWS Greengrass: Enables the deployment and management of applications on Snowball Edge devices in a local environment.

AWS Snowball Edge is a physical device that can be used to transfer large amounts of data in and out of AWS. It is designed for use cases where internet connectivity may be limited or nonexistent. In addition to data transfer, Snowball Edge also provides on-premises compute and storage capabilities, and can run a variety of AWS services and features locally.

A cloud practitioner needs to obtain AWS compliance reports before migrating an environment to the AWS Cloud. How can these reports be generated?

• A. Contact the AWS Compliance team.

• B. Download the reports from AWS Artifact.

• C. Open a case with AWS Support.

• D. Generate the reports with Amazon Made.

Answer explanation

The correct answer is B. Download the reports from AWS Artifact.

AWS Artifact is a portal that provides access to AWS compliance reports such as SOC reports, PCI DSS reports, and HIPAA reports. Customers can download these reports from AWS Artifact as part of their compliance obligations. AWS Artifact also provides access to other types of AWS agreements, such as the Business Associate Addendum (BAA) and the Enterprise Agreement (EA).

Distributing workloads across multiple Availability Zones supports which cloud architecture design principle?

• A. Implement automation.

• B. Design for agility.

• C. Design for failure.

• D. Implement elasticity.

Answer explanation

The correct answer is C. Design for failure.

Distributing workloads across multiple Availability Zones is a common practice for achieving high availability and resilience in cloud architectures. By spreading the workload across multiple Availability Zones, the system can continue to function even if one Availability Zone fails or experiences degraded performance. This helps to ensure that the workload remains available and can help prevent downtime or data loss. The design principle that this approach supports is "design for failure," which involves anticipating and preparing for failures in order to minimize their impact.

A user is planning to launch two additional Amazon EC2 instances to increase availability. Which action should the user take?

• A. Launch the instances across multiple Availability Zones in a single AWS Region

• B. Launch the instances as EC2 Reserved Instances in the same AWS Region and the same Availability Zone

• C. Launch the instances in multiple AWS Regions but in the same Availability Zone

• D. Launch the instances as EC2 Spot Instances in the same AWS Region but in different Availability Zones

Answer explanation

A. Launch the instances across multiple Availability Zones in a single AWS Region.

This would increase availability by distributing the instances across multiple isolated locations in the same region. Launching the instances as EC2 Reserved Instances in the same Availability Zone would provide capacity reservation, but would not increase availability in case of a failure in the Availability Zone. Launching the instances in multiple AWS Regions but in the same Availability Zone or launching them as EC2 Spot Instances in the same AWS Region but in different Availability Zones would not provide the same level of availability as launching them across multiple Availability Zones in a single AWS Region.

To avoid malicious compute activities, a user needs a quick way to determine if any Amazon EC2 instances have ports that allow Unrestricted access. Which AWS service will support this requirement?

• A. VPC Flow Logs

• B. AWS WAF

• C. AWS CloudTrail

• D. AWS Trusted Advisor

Answer explanation

The AWS service that can help a user determine if any Amazon EC2 instances have ports that allow unrestricted access is AWS Trusted Advisor. AWS Trusted Advisor is an online tool that inspects your AWS environment and provides real-time recommendations to help you optimize resources, improve security, and reduce costs. It provides a Security Check that analyzes your AWS resources and configuration settings to identify security gaps and help you improve your security posture. One of the checks is for unrestricted access to Amazon EC2 instances.