AWS SAA Study List - EC2

EC2

Basics

• Virtual image (AMI), instance in the cloud
• Varities of different OS versions
• Amazon Linux
• Red Hat Linux
• Windows Server 2016
• Different configurations of CPU and RAM
• Cost models
• Spot instances
• Reserved instances
• On-demand instances
• Can be deployed in multiple regions and availability zones
• Can be accessed securely by key pairs
• Can be stored by tags
• Security Groups act as firewall
• Elastic IP's can be attached to them
• Multiple ENI's can be attached to them
• Instance information can be queried by using metadata

Limits

EC2 doesn't have much limits, most limits are for EC2-Classic

Following topics are exam questions collected through Internet and should be evaluated as so. Answers are mine and have been checked with answers collected through the internet, but might still be wrong.

You have a web application running on six Amazon EC2 instances, consuming about 45% of resources on each instance. You are using auto-scaling to make sure that six instances are running at all times. The number of requests this application processes is consistent and does not experience spikes. The application is critical to your business and you want high availability at all times. You want the load to be distributed evenly between all instances. You also want to use the same Amazon Machine Image (AMI) for all instances. Which of the following architectural choices should you make?

A. Deploy 6 EC2 instances in one availability zone and use Amazon Elastic Load Balancer.
B. Deploy 3 EC2 instances in one region and 3 in another region and use Amazon Elastic Load Balancer.
C. Deploy 3 EC2 instances in one availability zone and 3 in another availability zone and use Amazon Elastic Load Balancer.
D. Deploy 2 EC2 instances in three regions and use Amazon Elastic Load Balancer.

Why? http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.html "A load balancer accepts incoming traffic from clients and routes requests to its registered EC2 instances in one or more Availability Zones." and in C answer remaing 3 EC2 instances can still service the remaining load. AMI is usually tied to Region, which rules out D and B.

You have launched an Amazon Elastic Compute Cloud (EC2) instance into a public subnet with a primary private IP address assigned, an internet gateway is attached to the VPC, and the public route table is configured to send all Internet-based traffic to the Internet gateway. The instance security group is set to allow all outbound traffic but cannot access the internet. Why is the Internet unreachable from this instance?

A. The instance does not have a public IP address.
B. The internet gateway security group must allow all outbound traffic.
C. The instance security group must allow all inbound traffic.
D. The instance “Source/Destination check” property must be enabled.

Why? https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.html "Enabling Internet Access: Ensure that instances in your subnet have public IP addresses or Elastic IP addresses." C can be ruled out, as you trying reach out from instance.  B can be ruled out as IGW (Internet Gateway) does not have security group. D is related to configuring NAT -instance.


You launch an Amazon EC2 instance without an assigned AWS Identity and Access Management (IAM) role. Later, you decide that the instance should be running with an IAM role. Which action must you take in order to have a running Amazon EC2 instance with an IAM role assigned to it?

A. Create an image of the instance, and register the image with an IAM role assigned and an Amazon EBS volume mapping.
B. Create a new IAM role with the same permissions as an existing IAM role, and assign it to the running instance.
C. Create an image of the instance, add a new IAM role with the same permissions as the desired IAM role, and deregister the image with the new role assigned.
D. Create an image of the instance, and use this image to launch a new instance with the desired IAM role assigned.

Why? A and C speaks of registering image, not launching the image. B is not possible, because you can't assign IAM role to running instance.


A client application requires operating system privileges on a relational database server. What is an appropriate configuration for a highly available database architecture?

A. A standalone Amazon EC2 instance
B. Amazon RDS in a Multi-AZ configuration
C. Amazon EC2 instances in a replication configuration utilizing a single Availability Zone
D. Amazon EC2 instances in a replication configuration utilizing two different Availability Zones

Why? RDS doesn't provide OS access, D is the only answer where you have OS rights and Multi-AZ configuration.


What is a placement group?

A. A collection of Auto Scaling groups in the same region
B. A feature that enables EC2 instances to interact with each other via high bandwidth, low latency connections
C. A collection of authorized CloudFront edge locations for a distribution
D. A collection of Elastic Load Balancers in the same Region or Availability Zone

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html "A placement group is a logical grouping of instances within a single Availability Zone. Placement groups are recommended for applications that benefit from low network latency, high network throughput, or both."


Which of the following are characteristics of a reserved instance? Choose 3 answers

A. It can be migrated across Availability Zones
B. It is specific to an Amazon Machine Image (AMI)
C. It can be applied to instances launched by Auto Scaling
D. It is specific to an instance Type
E. It can be used to lower Total Cost of Ownership (TCO) of a system

Why? Ruling out the wrong B and D leaves correct answer.


Which Amazon Elastic Compute Cloud feature can you query from within the instance to access instance properties?

A. Instance user data
B. Resource tags
C. Instance metadata
D. Amazon Machine Image

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-retrieval This can be done by queryering http://169.254.169.254/latest/meta-data


Which of the following requires a custom CloudWatch metric to monitor?

A. Memory Utilization of an EC2 instance
B. CPU Utilization of an EC2 instance
C. Disk usage activity of an EC2 instance
D. Data transfer of an EC2 instance

Why? http://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ecs-metricscollected.html where A is not part of this.


In order to optimize performance for a compute cluster that requires low inter-node latency, which of the following feature should you use?

A. Multiple Availability Zones
B. AWS Direct Connect
C. EC2 Dedicated Instances
D. Placement Groups
E. VPC private subnets


You have a distributed application that periodically processes large volumes of data across multiple Amazon EC2 Instances. The application is designed to recover gracefully from Amazon EC2 instance failures. You are required to accomplish this task in the most cost-effective way. Which of the following will meet your requirements?

A. Spot Instances
B. Reserved instances
C. Dedicated instances
D. On-Demand instances

Why? A sounds right because the question is mentioning that the application can recover gracefully from instances failure.


A company needs to deploy services to an AWS region which they have not previously used. The company currently has an AWS identity and Access Management (IAM) role for the Amazon EC2 instances, which permits the instance to have access to Amazon DynamoDB. The company wants their EC2 instances in the new region to have the same privileges. How should the company achieve this?

A. Create a new IAM role and associated policies within the new region
B. Assign the existing IAM role to the Amazon EC2 instances in the new region
C. Copy the IAM role and associated policies to the new region and attach it to the instances
D. Create an Amazon Machine Image (AMI) of the instance and copy it to the desired region using the AMI Copy feature

Why? IAM roles are global.


You try to connect via SSH to a newly created Amazon EC2 instance and get one of the following error messages: “Network error: Connection timed out” or “Error connecting to [instance], reason: -> Connection timed out: connect,” You have confirmed that the network and security group rules are configured correctly and the instance is passing status checks. What steps should you take to identify the source of the behavior? Choose 2 answers

A. Verify that the private key file corresponds to the Amazon EC2 key pair assigned at launch.
B. Verify that your IAM user policy has permission to launch Amazon EC2 instances.
C. Verify that you are connecting with the appropriate user name for your AMI.
D. Verify that the Amazon EC2 Instance was launched with the proper IAM role.
E. Verify that your federation trust to AWS has been established.

Why? AC although each option is wrong in the following


You have an application running on an EC2 Instance which will allow users to download files from a private S3 bucket using a pre-assigned URL. Before generating the URL the application should verify the existence of the file in S3. How should the application use AWS credentials to access the S3 bucket securely?

A. Use the AWS account access keys. The application retrieves the credentials from the source code of the application.
B. Create a IAM user for the application with permissions that allow list access to the S3 bucket. Launch the instance as the IAM user and retrieve the IAM user’s credentials from the EC2 instance user data.
C. Create an IAM role for EC2 that allows list access to objects in the S3 bucket. Launch the instance with the role, and retrieve the role’s credentials from the EC2 Instance metadata
D. Create an IAM user for the application with permissions that allow list access to the S3 bucket. The application retrieves the IAM user credentials from a temporary directory with permissions that allow read access only to the application user.

Why? Ruling out A which is not secure and D which speak of temporary directory. B can be ruled out (without looking at the IAM user at all) because it uses wrong term "EC2 instance user data, instead of meta-data".


"____" acts as a firewall that controls the traffic allowed to reach one or more instances.

A. security group
B. nACL
C. IAM
D. Private IP Addresses

Why? nACL are used at subnet level, where as security groups act on instance level.


Fill in the blanks : let you categorize your EC2 resources in different ways, for example, by purpose, owner, or environment.

A. Tags
B. special filters
C. pointers
D. functions

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html "To help you manage your instances, images, and other Amazon EC2 resources, you can optionally assign your own metadata to each resource in the form of tags."


How many types of block devices does Amazon EC2 support?

A. 2
B. 4
C. 3
D. 1

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html "Amazon EC2 supports two types of block devices: Instance store volumes (virtual devices whose underlying hardware is physically attached to the host computer for the instance)
EBS volumes (remote storage devices)"

You must assign each server to at least _____ security group

A. 3
B. 2
C. 4
D. 1

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html "A security group acts as a virtual firewall that controls the traffic for one or more instances. When you launch an instance, you associate one or more security groups with the instance."


What are the initial settings of an user created security group?

A. Allow all inbound traffic and Allow no outbound traffic
B. Allow no inbound traffic and Allow no outbound traffic
C. Allow no inbound traffic and Allow all outbound traffic
D. Allow all inbound traffic and Allow all outbound traffic

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#default-security-group "A default security group is named default, and it has an ID assigned by AWS. The following are the initial settings for each default security group: Allow inbound traffic only from other instances associated with the default security group
Allow all outbound traffic from the instance"

Fill in the blanks: The base URI for all requests for instance metadata is ___________

A. http://254.169.169.254/latest/
B. http://169.169.254.254/latest/
C. http://127.0.0.1/latest/
D. http://169.254.169.254/latest/

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html "To view all categories of instance metadata from within a running instance, use the following URI: http://169.254.169.254/latest/meta-data/"


While creating the snapshots using the command line tools, which command should I be using?

A. ec2-deploy-snapshot
B. ec2-fresh-snapshot
C. ec2-create-snapshot
D. ec2-new-snapshot

Why? http://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html


What are the Amazon EC2 API tools?

A. They don’t exist. The Amazon EC2 AMI tools, instead, are used to manage permissions.
B. Command-line tools to the Amazon EC2 web service.
C. They are a set of graphical tools to manage EC2 instances.
D. They don’t exist. The Amazon API tools are a client interface to Amazon Web Services.

Why? https://aws.amazon.com/developertools/351 "The API tools serve as the client interface to the Amazon EC2 web service. Use these tools to register and launch instances, manipulate security groups, and more."


Fill in the blanks: _________ let you categorize your EC2 resources in different ways, for example, by purpose, owner, or environment.

A. wildcards
B. pointers
C. tags
D. special filters

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html

What does the following command do with respect to the Amazon EC2 security groups? ec2-revoke RevokeSecurityGroupIngress

A. Removes one or more security groups from a rule.
B. Removes one or more security groups from an Amazon EC2 instance.
C. Removes one or more rules from a security group.
D. Removes a security group from our account.

Why? http://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html "Removes one or more ingress rules from a security group."


Can I move a Reserved Instance from one Region to another?

A. No
B. Only if they are moving into GovCloud
C. Yes
D. Only if they are moving to US East from another region

Why? https://aws.amazon.com/ec2/faqs/ "Q: Can I transfer a Convertible or Standard Reserved Instance from one region to another? No, a Reserved Instance is associated with a specific region, which is fixed for the duration of the reservation's term.". You can though move them inside the Region between Availability Zones.


What does specifying the mapping /dev/sdc=none when launching an instance do?

A. Prevents /dev/sdc from creating the instance.
B. Prevents /dev/sdc from deleting the instance.
C. Set the value of /dev/sdc to ‘zero’.
D. Prevents /dev/sdc from attaching to the instance.

Why? http://docs.aws.amazon.com/AWSEC2/latest/CommandLineReference/ec2-clt.pdf "Each entry is passed in the form <devicename>=<blockdevice>. The devicename is the device name of the physical device on the instance to map, and blockdevice can be one of the following values:
• none – Suppresses an existing mapping of the device from the AMI used to launch the instance. For example: "/dev/sdc=none"."


What does the following command do with respect to the Amazon EC2 security groups? ec2-create-group CreateSecurityGroup

A. Groups the user created security groups in to a new group for easy access.
B. Creates a new security group for use with your account.
C. Creates a new group inside the security group.
D. Creates a new rule inside the security group.

Why? http://docs.aws.amazon.com/cli/latest/reference/ec2/create-security-group.html "Creates a security group. A security group is for use with instances either in the EC2-Classic platform or in a specific VPC."

While performing the volume status checks, if the status is insufficient-data, what does it mean?

A. the checks may still be in progress on the volume
B. the check has passed
C. the check has failed

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-volume-status.html#monitoring-volume-checks "Volume status checks are automated tests that run every 5 minutes and return a pass or fail status. If all checks pass, the status of the volume is ok. If a check fails, the status of the volume is impaired. If the status is insufficient-data, the checks may still be in progress on the volume. You can view the results of volume status checks to identify any impaired volumes and take any necessary actions."


While creating the snapshots using the API, which Action should I be using?

A. MakeSnapShot
B. FreshSnapshot
C. DeploySnapshot
D. CreateSnapshot

Why? http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshot.html

Please select the Amazon EC2 resource which cannot be tagged.

A. Images (AMIs, kernels, RAM disks)
B. Amazon EBS volumes
C. Elastic IP addresses
D. VPCs

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#tag-restrictions "Elastic IP, Tagging Support: No"


The one-time payment for Reserved Instances is __________ refundable if the reservation is cancelled.

A. always
B. in some circumstances
C. never

Why? https://aws.amazon.com/ec2/pricing/reserved-instances/buyer/ "Purchases of Reserved Instances are non-refundable."

Amazon EC2 has no Amazon Resource Names (ARNs) because you can’t specify a particular Amazon EC2 resource in an IAM policy.

A. TRUE
B. FALSE

Why? http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-ec2

Can I detach the primary (eth0) network interface when the instance is running or stopped?

A. Yes, You can.
B. No. You cannot
C. Depends on the state of the interface at the time

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#detach_eni "You cannot detach a primary network interface from an instance"


What’s an ECU?

A. Extended Cluster User.
B. None of these.
C. Elastic Computer Usage.
D. Elastic Compute Unit.

https://aws.amazon.com/ec2/faqs/ "The EC2 Compute Unit (ECU)"


Amazon EC2 provides a repository of public data sets that can be seamlessly integrated into AWS cloud-based applications. What is the monthly charge for using the public data sets?

A. A 1 time charge of 10$ for all the datasets.
B. 1$ per dataset per month
C. 10$ per month for all the datasets
D. There is no charge for using the public data sets

https://aws.amazon.com/public-data-sets/ "AWS hosts a variety of public datasets that anyone can access for free."


The Amazon EC2 web service can be accessed using the _____ web services messaging protocol. This interface is described by a Web Services Description Language (WSDL) document.

A. SOAP
B. DCOM
C. CORBA
D. XML-RPC

Why? http://docs.aws.amazon.com/AWSECommerceService/latest/DG/WSDLLocation.html "The WSDL contains all the API endpoints. To select the required endpoint, see your SOAP framework."


You have multiple Amazon EC2 instances running in a cluster across multiple Availability Zones within the same region. What combination of the following should be used to ensure the highest network performance (packets per second), lowest latency, and lowest jitter? Choose 3 answers

A. Amazon EC2 placement groups
B. Enhanced networking
C. Amazon PV AMI
D. Amazon HVM AMI
E. Amazon Linux
F. Amazon VPC

Why? Ruling out A, as placement group cannot span multiple AZ's. After this, you can check this: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualization_types.html "HVM AMIs are required to take advantage of enhanced networking and GPU processing. In order to pass through instructions to specialized network and GPU devices, the OS needs to be able to have access to the native hardware platform; HVM virtualization provides this access. For more information, see Enhanced Networking and Linux Accelerated Computing Instances.". This rules out PV AMI and VPC.

The one-time payment for Reserved Instances is __________ refundable if the reservation is cancelled.

A. always
B. in some circumstances
C. never

Why? https://aws.amazon.com/ec2/pricing/reserved-instances/buyer/ "Purchases of Reserved Instances are non-refundable."


By default what are ENIs that are automatically created and attached to instances using the EC2 console set to do when the attached instance terminates?

A. Remain as is
B. Terminate
C. Hibernate
D. Pause

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_term_behavior "By default, elastic network interfaces that are automatically created and attached to instances using the console are set to terminate when the instance terminates. However, network interfaces created using the command line interface aren't set to terminate when the instance terminates."

Select the correct set of steps for exposing the snapshot only to specific AWS accounts

A. Select public for all the accounts and check mark those accounts with whom you want to expose the  snapshots and click Save.
B. SelectPrivate, enter the IDs of those AWS accounts, and click Save.
C. SelectPublic, enter the IDs of those AWS accounts, and click Save.
D. SelectPublic, mark the IDs of those AWS accounts as private, and click Save.

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html "To expose the snapshot to only specific AWS accounts, choose Private, enter the ID of the AWS account (without hyphens) in the AWS Account Number field, and choose Add Permission. Repeat until you've added all the required AWS accounts."


Which DNS name can only be resolved within Amazon EC2?

A. Internal DNS name
B. External DNS name
C. Global DNS name
D. Private DNS name

https://aws.amazon.com/about-aws/whats-new/2014/11/05/amazon-route-53-now-supports-private-dns-with-amazon-vpc/ "You can use the Route 53 Private DNS feature to manage authoritative DNS within your Virtual Private Clouds (VPCs), so you can use custom domain names for your internal AWS resources without exposing DNS data to the public Internet."

Select the correct statement:

A. You don’t need not specify the resource identifier while stopping a resource
B. You can terminate, stop, or delete a resource based solely on its tags
C. You can’t terminate, stop, or delete a resource based solely on its tags
D. You don’t need to specify the resource identifier while terminating a resource

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#tag-restrictions
"You can't terminate, stop, or delete a resource based solely on its tags; you must specify the resource identifier."


Select the incorrect statement

A. In Amazon EC2, the private IP addresses only returned to Amazon EC2 when the instance is stopped or terminated
B. In Amazon VPC, an instance retains its private IP addresses when the instance is stopped.
C. In Amazon VPC, an instance does NOT retain its private IP addresses when the instance is stopped.
D. In Amazon EC2, the private IP address is associated exclusively with the instance for its lifetime

Why? C is false, instance does retain it's private IP when stopped


Making your snapshot public shares all snapshot data with everyone. Can the snapshots with AWS Marketplace product codes be made public?

A. No
B. Yes

Why? http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyImageAttribute.html "AWS Marketplace product codes cannot be modified. Images with an AWS Marketplace product code cannot be made public."

If I write the below command, what does it do?
ec2-run ami-e3a5408a -n 20 -g appserver

A. Start twenty instances as members of appserver group.
B. Creates 20 rules in the security group named appserver
C. Terminate twenty instances as members of appserver group.
D. Start 20 security groups

Why? http://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html


All Amazon EC2 instances are assigned two IP addresses at launch, out of which one can only be reached from within the Amazon EC2 network?

A. Multiple IP address
B. Public IP address
C. Private IP address
D. Elastic IP Address

Why? Private addresses can only be reached inside VPC.


If I want an instance to have a public IP address, which IP address should I use?

A. Elastic IP Address
B. Class B IP Address
C. Class A IP Address
D. Dynamic IP Address

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html

When will you incur costs with an Elastic IP address (EIP)?

A. When an EIP is allocated.
B. When it is allocated and associated with a running instance.
C. When it is allocated and associated with a stopped instance.
D. Costs are incurred regardless of whether the EIP is associated with a running instance.

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html "EC2-VPC: The instance retains its associated Elastic IP addresses. You're charged for any Elastic IP addresses associated with a stopped instance."


You are tasked with setting up a Linux bastion host for access to Amazon EC2 instances running in your VPC. Only clients connecting from the corporate external public IP address 72.34.51.100 should have SSH access to the host. Which option will meet the customer requirement?

A. Security Group Inbound Rule: Protocol – TCP. Port Range – 22, Source 72.34.51.100/32
B. Security Group Inbound Rule: Protocol – UDP, Port Range – 22, Source 72.34.51.100/32
C. Network ACL Inbound Rule: Protocol – UDP, Port Range – 22, Source 72.34.51.100/32
D. Network ACL Inbound Rule: Protocol – TCP, Port Range-22, Source 72.34.51.100/0

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html "For example, if your IP address is 203.0.113.25, specify 203.0.113.25/32 to list this single IP address in CIDR notation. " also you can rule out UDP -protocol right way as /0 is bad IP mask.

If you want to launch Amazon Elastic Compute Cloud (EC2) instances and assign each instance a predetermined private IP address you should:

A. Launch the instance from a private Amazon Machine Image (AMI).
B. Assign a group of sequential Elastic IP address to the instances.
C. Launch the instances in the Amazon Virtual Private Cloud (VPC).
D. Launch the instances in a Placement Group.
E. Use standard EC2 instances since each instance gets a private Domain Name Service (DNS) already.

Why? http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html "When you launch an instance into a VPC, a primary private IP address from the address range of the subnet is assigned to the default network interface (eth0) of the instance. Each instance is also given an internal DNS hostname that resolves to the private IP address of the instance."

An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and deny all outbound traffic. The instance’s security group is configured to allow SSH from any IP address and deny all outbound traffic. What changes need to be made to allow SSH access to the instance?

A. The outbound security group needs to be modified to allow outbound traffic.
B. The outbound network ACL needs to be modified to allow outbound traffic.
C. Nothing, it can be accessed from any IP address using SSH.
D. Both the outbound security group and outbound network ACL need to be modified to allow outbound traffic.

Why? Security Groups are stateful and nACL are stateless, meaning that you need to allow both incoming and outcoming SSH-traffic in stateless nACL whereas in Security Group requires the rule be found on either incoming/outgoing rules.

A company is building a two-tier web application to serve dynamic transaction-based content. The data tier is leveraging an Online Transactional Processing (OLTP) database. What services should you leverage to enable an elastic and scalable web tier?

A. Elastic Load Balancing, Amazon EC2, and Auto Scaling
B. Elastic Load Balancing, Amazon RDS with Multi-AZ, and Amazon S3
C. Amazon RDS with Multi-AZ and Auto Scaling
D. Amazon EC2, Amazon DynamoDB, and Amazon S3

Why? DB-tier is already provided and hence you should focus on the web-tier in the answer.


Per the AWS Acceptable Use Policy, penetration testing of EC2 instances:

A. May be performed by AWS, and will be performed by AWS upon customer request.
B. May be performed by AWS, and is periodically performed by AWS.
C. Are expressly prohibited under all circumstances.
D. May be performed by the customer on their own instances with prior authorization from AWS.
E. May be performed by the customer on their own instances, only if performed from EC2 instances

Why? https://aws.amazon.com/security/penetration-testing/ "To request permission, you must be logged into the AWS portal using the root credentials associated with the instances you wish to test, otherwise the form will not pre-populate correctly. If you have hired a third party to conduct your testing, we suggest that you complete the form and then notify your third party when we grant approval."


You have an environment that consists of a public subnet using Amazon VPC and 3 instances that are running in this subnet. These three instances can successfully communicate with other hosts on the Internet. You launch a fourth instance in the same subnet, using the same AMI and security group configuration you used for the others, but find that this instance cannot be accessed from the internet. What should you do to enable Internet access?

A. Deploy a NAT instance into the public subnet.
B. Assign an Elastic IP address to the fourth instance.
C. Configure a publically routable IP Address in the host OS of the fourth instance.
D. Modify the routing table for the public subnet.

A customer is running a multi-tier web application farm in a virtual private cloud (VPC) that is not connected to their corporate network. They are connecting to the VPC over the Internet to manage all of their Amazon EC2 instances running in both the public and private subnets. They have only authorized the bastion-security-group with Microsoft Remote Desktop Protocol (RDP) access to the application instance security groups, but the company wants to further limit administrative access to all of the instances in the VPC. Which of the following Bastion deployment scenarios will meet this requirement?

A. Deploy a Windows Bastion host on the corporate network that has RDP access to all instances in the VPC.
B. Deploy a Windows Bastion host with an Elastic IP address in the public subnet and allow SSH access to the bastion from anywhere.
C. Deploy a Windows Bastion host with an Elastic IP address in the private subnet, and restrict RDP access to the bastion from only the corporate public IP addresses.
D. Deploy a Windows Bastion host with an auto-assigned Public IP address in the public subnet, and allow RDP access to the bastion from only the corporate public IP addresses.

Why? You can rule out B, as it speaks of SSH. C speaks of assigning the Bastion into private subnet (which would disable access from Internet). Same logic applies to A.

AWS SAA Study List - EBS

Elastic Block Store

Basics

• Block level storage
• NAS disks, which live outside the EC2 instance
• Provides general purpose GP2, provisioned IOPS, throughput optimised and HDD disks
• Can be used as boot volume
• Can be snapshotted
• EBS snapshots can be copied to another region
• Can be used in RAID configurations (RAID 5 and RAID 6 are not recommended)
• Provisioned IOPS disks are billed if attached to stopped instance

Limits

• Maximum 5000 EBS volumes
• Maximum 10,000 EBS snapshots
• Maximum total volume per disk type (GP2, PIOPS..) 20TiB
• Maximum total provisioned IOPS is 40,000
• Can be attached to only one EC2 instance (no shared volumes)

Following topics are exam questions collected through Internet and should be evaluated as so. Answers are mine and have been checked with answers collected through the internet, but might still be wrong.

When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral store volumes?

A. Data is automatically saved in an EBS volume.
B. Data is unavailable until the instance is restarted.
C. Data will be deleted and will no longer be accessible.
D. Data is automatically saved as an EBS snapshot.

Why? Ephemeral storage is same as instance store. http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html "The data in an instance store persists only during the lifetime of its associated instance."

When creation of an EBS snapshot is initiated, but not completed, the EBS volume:

A. Can be used while the snapshot is in progress.
B. Cannot be detached or attached to an EC2 instance until the snapshot completes
C. Can be used in read-only mode while the snapshot is in progress.
D. Cannot be used until the snapshot completes.

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html "Snapshots occur asynchronously; the point-in-time snapshot is created immediately, but the status of the snapshot is pending until the snapshot is complete (when all of the modified blocks have been transferred to Amazon S3), which can take several hours for large initial snapshots or subsequent snapshots where many blocks have changed. While it is completing, an in-progress snapshot is not affected by ongoing reads and writes to the volume."

How can you secure data at rest on an EBS volume?

A. Attach the volume to an instance using EC2’s SSL interface.
B. Write the data randomly instead of sequentially.
C. Encrypt the volume using the S3 server-side encryption service.
D. Create an IAM policy that restricts read and write access to the volume.
E. Use an encrypted file system on top of the EBS volume.

Why? Ruling out technique leaves E as only option.


Which procedure for backing up a relational database on EC2 that is using a set of RAlDed EBS volumes for storage minimizes the time during which the database cannot be written to and results in a consistent backup?

A. 1. Detach EBS volumes, 2. Start EBS snapshot of volumes, 3. Re-attach EBS volumes
B. 1. Stop the EC2 Instance. 2. Snapshot the EBS volumes
C. 1. Suspend disk I/O, 2. Create an image of the EC2 Instance, 3. Resume disk I/O
D. 1. Suspend disk I/O, 2. Start EBS snapshot of volumes, 3. Resume disk I/O
E. 1. Suspend disk I/O, 2. Start EBS snapshot of volumes, 3. Wait for snapshots to complete, 4. Resume disk I/O

Why? https://aws.amazon.com/premiumsupport/knowledge-center/snapshot-ebs-raid-array/ "To create an "application-consistent" snapshot of your RAID array, stop applications from writing to the RAID array, and flush all caches to disk. Then ensure that the associated EC2 instance is no longer writing to the RAID array by taking steps such as freezing the file system, unmounting the RAID array, or shutting down the associated EC2 instance. After completing the steps to halt all I/O, take a snapshot of each EBS volume."


When an EC2 instance that is backed by an S3-based AMI is terminated, what happens to the data on the root volume?

A. Data is automatically saved as an EBS snapshot.
B. Data is automatically saved as an EBS volume.
C. Data is unavailable until the instance is restarted.
D. Data is automatically deleted.

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ComponentsAMIs.html "All AMIs are categorized as either backed by Amazon EBS or backed by instance store. The former means that the root device for an instance launched from the AMI is an Amazon EBS volume created from an Amazon EBS snapshot. The latter means that the root device for an instance launched from the AMI is an instance store volume created from a template stored in Amazon S3."


Which of the following instance types are available as Amazon EBS-backed only? Choose 2 answers

A. General purpose T2
B. General purpose M3
C. Compute-optimized C4
D. Compute-optimized C3
E. Storage-optimized 12

Why? https://aws.amazon.com/ec2/instance-types/ As of 10/2016 T2 and C4 are only with EBS-backed only

Which of the following are true regarding encrypted Amazon Elastic Block Store (EBS) volumes? Choose 2 answers

A. Supported on all Amazon EBS volume types
B. Snapshots are automatically encrypted
C. Available to all instance types
D. Existing volumes can be encrypted
E. Shared volumes can be encrypted

Why? https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html "Amazon EBS encryption is only available on certain instance types.", "All snapshots created from the volume" and you can rule out D as you can encrypt volumes which are created as unencrypted. "There is no direct way to encrypt an existing unencrypted volume, or to remove encryption from an encrypted volume. However, you can migrate data between encrypted and unencrypted volumes."

A t2.medium EC2 instance type must be launched with what type of Amazon Machine Image (AMI)?

A. An Instance store Hardware Virtual Machine AMI
B. An Instance store Paravirtual AMI
C. An Amazon EBS-backed Hardware Virtual Machine AMI
D. An Amazon EBS-backed Paravirtual AMI

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html list t2.medium as HVM-EBS combination


Which of the following approaches provides the lowest cost for Amazon Elastic Block Store snapshots while giving you the ability to fully restore data?

A. Maintain two snapshots: the original snapshot and the latest incremental snapshot.
B. Maintain a volume snapshot; subsequent snapshots will overwrite one another
C. Maintain a single snapshot; the latest snapshot is both incremental and complete.
D. Maintain the most current snapshot, archive the original and incremental to Amazon Glacier.

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-deleting-snapshot.html "If you make periodic snapshots of a volume, the snapshots are incremental so that only the blocks on the device that have changed since your last snapshot are saved in the new snapshot. Even though snapshots are saved incrementally, the snapshot deletion process is designed so that you need to retain only the most recent snapshot in order to restore the volume."

An existing application stores sensitive information on a non-boot Amazon EBS data volume attached to an Amazon Elastic Compute Cloud instance. Which of the following approaches would protect the sensitive data on an Amazon EBS volume?

A. Upload your customer keys to AWS CloudHSM. Associate the Amazon EBS volume with AWS CloudHSM. Remount the Amazon EBS volume.
B. Create and mount a new, encrypted Amazon EBS volume. Move the data to the new volume. Delete the old Amazon EBS volume.
C. Unmount the EBS volume. Toggle the encryption attribute to True. Re-mount the Amazon EBS volume.
D. Snapshot the current Amazon EBS volume. Restore the snapshot to a new, encrypted Amazon EBS volume. Mount the Amazon EBS volume

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#EBSEncryption_supported_instances "While copying an unencrypted snapshot of an unencrypted volume, you can encrypt the copy. Volumes restored from this encrypted copy will also be encrypted."


A user has created numerous EBS volumes. What is the general limit for each AWS account for the maximum number of EBS volumes that can be created?
A. 10000
B. 5000
C. 100
D. 1000

Why? http://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html#limits_ebs


Your company policies require encryption of sensitive data at rest. You are considering the possible options for protecting data while storing it at rest on an EBS data volume, attached to an EC2 instance. Which of these options would allow you to encrypt your data at rest? (Choose 3 answers)

A. Implement third party volume encryption tools
B. Do nothing as EBS volumes are encrypted by default
C. Encrypt data inside your applications before storing it on EBS
D. Encrypt data using native data encryption drivers at the file system level
E. Implement SSL/TLS for all services running on the server

Why? Ruling out E (as it speaks of SSL) and B as EBS volumes are not encrypted by default.


How are the EBS snapshots saved on Amazon S3?

A. Exponentially
B. Incrementally
C. EBS snapshots are not stored in the Amazon S3
D. Decrementally

Why? Only logical answer is Incrementally.


Before I delete an EBS volume, what can I do if I want to recreate the volume later?

A. Create a copy of the EBS volume (not a snapshot)
B. Store a snapshot of the volume
C. Download the content to an EC2 instance
D. Back up the data in to a physical disk

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-deleting-volume.html "However, before deletion, you can store a snapshot of the volume, which you can use to re-create the volume later."


Select the most correct answer: The device name /dev/sda1 (within Amazon EC2) is _____

A. Possible for EBS volumes
B. Reserved for the root device
C. Recommended for EBS volumes
D. Recommended for instance store volumes

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/RootDeviceStorage.html The root device is typically /dev/sda1 (Linux) or xvda (Windows).

When you view the block device mapping for your instance, you can see only the EBS volumes, not the instance store volumes.

A. Depends on the instance type
B. FALSE
C. Depends on whether you use API call
D. TRUE

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html#bdm-instance-metadata "Viewing the Instance Block Device Mapping for Instance Store Volumes: When you view the block device mapping for your instance, you can see only the EBS volumes, not the instance store volumes. You can use instance metadata to query the complete block device mapping. The base URI for all requests for instance metadata is http://169.254.169.254/latest/."


By default, EBS volumes that are created and attached to an instance at launch are deleted when that instance is terminated. You can modify this behavior by changing the value of the flag_____ to false when you launch the instance

A. DeleteOnTermination
B. RemoveOnDeletion
C. RemoveOnTermination
D. TerminateOnDeletion

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html "By default, Amazon EBS root device volumes are automatically deleted when the instance terminates. However, by default, any additional EBS volumes that you attach at launch, or any EBS volumes that you attach to an existing instance persist even after the instance terminates. This behavior is controlled by the volume's DeleteOnTermination attribute, which you can modify."


What will be the status of the snapshot until the snapshot is complete.

A. running
B. working
C. progressing
D. pending

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html "Although you can take a snapshot of a volume while a previous snapshot of that volume is in the pending status, having multiple pending snapshots of a volume may result in reduced volume performance until the snapshots complete."


Can we attach an EBS volume to more than one EC2 instance at the same time?

A. No
B. Yes.
C. Only EC2-optimized EBS volumes.
D. Only in read mode.

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumes.html "An EBS volume can be attached to only one instance at a time within the same Availability Zone. However, multiple volumes can be attached to a single instance."


EBS Snapshots occur _____

A. Asynchronously
B. Synchronously
C. Weekly

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html "Snapshots occur asynchronously; the point-in-time snapshot is created immediately, but the status of the snapshot is pending until the snapshot is complete (when all of the modified blocks have been transferred to Amazon S3), which can take several hours for large initial snapshots or subsequent snapshots where many blocks have changed."



Out of the stripping options available for the EBS volumes, which one has the following disadvantage :‘Doubles the amount of I/O required from the instance to EBS compared to RAID 0, because you’re mirroring all writes to a pair of volumes, limiting how much you can stripe.’ ?

A. RAID 0
B. RAID 1+0 (RAID 10)
C. RAID 1
D. RAID

Why? https://en.wikipedia.org/wiki/Standard_RAID_levels "RAID 1 consists of an exact copy (or mirror) of a set of data on two or more disks; a classic RAID 1 mirrored pair contains two disks. This configuration offers no parity, striping, or spanning of disk space across multiple disks, since the data is mirrored on all disks belonging to the array, and the array can only be as big as the smallest member disk. This layout is useful when read performance or reliability is more important than write performance or the resulting data storage capacity."


By default, when an EBS volume is attached to a Windows instance, it may show up as any drive letter on the instance. You can change the settings of the _____ Service to set the drive letters of the EBS volumes per your specifications.

A. EBSConfig
B. AMIConfig
C. Ec2Config
D. Ec2-AMIConfig

Why? http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/UsingConfig_WinAMI.html "Configuring a Windows Instance Using the EC2Config Service: Drive Letter Mapping"

In the ‘Detailed’ monitoring data available for your Amazon EBS volumes, Provisioned IOPS volumes automatically send _____ minute metrics to Amazon CloudWatch.

A. 3
B. 1
C. 5
D. 2

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html "Data is available in 1-minute periods for an additional cost."

Can I delete a snapshot of the root device of an EBS volume used by a registered AMI?

A. Only via API
B. Only via Console
C. Yes
D. No

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-deleting-snapshot.html "Note that you can't delete a snapshot of the root device of an EBS volume used by a registered AMI. You must first deregister the AMI before you can delete the snapshot."

If an Amazon EBS volume is the root device of an instance, can I detach it without stopping the instance?

A. Yes, but only if Windows instance
B. No
C. Yes
D. Yes, but only if a Linux instance

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.html "If an EBS volume is the root device of an instance, you must stop the instance before you can detach the volume."


Is it possible to access your EBS snapshots?

A. Yes, through the Amazon S3 APIs.
B. Yes, through the Amazon EC2 APIs.
C. No, EBS snapshots cannot be accessed; they can only be used to create a new EBS volume.
D. EBS doesn’t provide snapshots.

Why? https://aws.amazon.com/ebs/faqs/?nc1=h_ls "Q: Will I be able to access my snapshots using the regular Amazon S3 API? No, snapshots are only available through the Amazon EC2 API."


What does Amazon EBS stand for?

A. Elastic Block Storage
B. Elastic Business Server
C. Elastic Blade Server
D. Elastic Block Store

Why? https://aws.amazon.com/ebs/ "Amazon Elastic Block Store (EBS)"


How can an EBS volume that is currently attached to an EC2 instance be migrated from one Availability Zone to another?

A. Detach the volume and attach it to another EC2 instance in the other AZ.
B. Simply create a new volume in the other AZ and specify the original volume as the source.
C. Create a snapshot of the volume, and create a new volume from the snapshot in the other AZ.
D. Detach the volume, then use the ec2-migrate-volume command to move it to another AZ.

Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-copy-snapshot.html "With Amazon EBS, you can create point-in-time snapshots of volumes which we store for you in Amazon Simple Storage Service (Amazon S3). After you've created a snapshot and it has finished copying to Amazon S3 (when the snapshot status is completed), you can copy it from one AWS region to another, or within the same region. "


Provisioned IOPS Costs: you are charged for the IOPS and storage whether or not you use them in a given month.

A. FALSE
B. TRUE

Why? https://aws.amazon.com/ebs/pricing/ "You will be charged for the IOPS provisioned on a volume even when the volume is detached from an instance."

AWS SAA Study List - AutoScaling

AutoScaling

Basics

• AutoScaling increases or decreases the amount of EC2 instances based on policy
• Helps on scaling when the demand is higher or lower
• Based on 
• launch configuration which determines what to launch (AMI configuration)
• groups, which are set of EC2 instances set scale in and out based on policy
• policy what determines when to scale in and out and how much
• Can be used together with ELB health checks
• Can span multiple availability zones within region
• Uses health checks to determine the status of EC2 instance
• Sends data to CloudWatch about the ELB and EC2 instances

Limits

• Maximum amount of launch configurations is 100
• Maximum amount of AutoScaling groups is 20
• Maximum amount of scaling policies per AutoScaling group is 50

Default termination policy

• Policy can be changed if desired
• Availability Zone with most instances is selected first
• EC2 with oldest configuration is deleted first
• Instance closest to the next billing hour is deleted first
• If all of above are satisfied, instance is selected in random

Following topics are exam questions collected through Internet and should be evaluated as so. Answers are mine and have been checked with answers collected through the internet, but might still be wrong.

A user is trying to setup a scheduled scaling activity using Auto Scaling. The user wants to setup the recurring schedule. Which of the below mentioned parameters is not required in this case?
A. Maximum size
B. Auto Scaling group name
C. End time
D. Recurrence value

Why? Below is screenshot from my AutoScaling console.
 


A user has configured Auto Scaling with 3 instances. The user had created a new AMI after updating one of the instances. If the user wants to terminate two specific instances to ensure that Auto Scaling launches an instances with the new launch configuration, which command should he run?

A. as-delete-instance-in-auto-scaling-group <Instance ID> –no-decrement-desired-capacity
B. as-terminate-instance-in-auto-scaling-group <Instance ID> –update-desired-capacity
C. as-terminate-instance-in-auto-scaling-group <Instance ID> –decrement-desired-capacity
D. as-terminate-instance-in-auto-scaling-group <Instance ID> –no-decrement-desired-capacity

Why? https://docs.aws.amazon.com/cli/latest/reference/autoscaling/terminate-instance-in-auto-scaling-group.html

--should-decrement-desired-capacity | --no-should-decrement-desired-capacity (boolean)

If true , terminating the instance also decrements the size of the Auto Scaling group.

A user is planning to scale up an application by 8 AM and scale down by 7 PM daily using Auto Scaling. What should the user do in this case?

A. Setup the scaling policy to scale up and down based on the CloudWatch alarms
B. User should increase the desired capacity at 8 AM and decrease it by 7 PM manually
C. User should setup a batch process which launches the EC2 instance at a specific time
D. Setup scheduled actions to scale up or down at a specific time

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/schedule_time.html


An organization has setup Auto Scaling with ELB. Due to some manual error, one of the instances got rebooted. Thus, it failed the Auto Scaling health check. Auto Scaling has marked it for replacement. How can the system admin ensure that the instance does not get terminated?

A. Update the Auto Scaling group to ignore the instance reboot event
B. It is not possible to change the status once it is marked for replacement
C. Manually add that instance to the Auto Scaling group after reboot to avoid replacement
D. Change the health of the instance to healthy using the Auto Scaling commands

Why? http://docs.aws.amazon.com/cli/latest/reference/autoscaling/set-instance-health.html

--health-status (string)

The health status of the instance. Set to Healthy if you want the instance to remain in service. Set to Unhealthy if you want the instance to be out of service. Auto Scaling will terminate and replace the unhealthy instance.

A user has configured Auto Scaling with the minimum capacity as 2 and the desired capacity as 2. The user is trying to terminate one of the existing instance with the command: as-terminate-instance-in-auto-scaling-group<Instance ID> –decrement-desired-capacity. What will Auto Scaling do in this scenario?

A. Terminates the instance and does not launch a new instance
B. Terminates the instance and updates the desired capacity to 1
C. Terminates the instance and updates the desired capacity & minimum size to 1
D. Throws an error


An organization has configured Auto Scaling for hosting their application. The system admin wants to understand the Auto Scaling health check process. If the instance is unhealthy, Auto Scaling launches an instance and terminates the unhealthy instance. What is the order execution?

A. Auto Scaling launches a new instance first and then terminates the unhealthy instance
B. Auto Scaling performs the launch and terminate processes in a random order
C. Auto Scaling launches and terminates the instances simultaneously
D. Auto Scaling terminates the instance first and then launches a new instance

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/as-maintain-instance-levels.html#replace-unhealthy-instance "After an instance has been marked unhealthy as a result of an Amazon EC2 or Elastic Load Balancing health check, it is almost immediately scheduled for replacement. It never automatically recovers its health. You can intervene manually by calling the SetInstanceHealth action (or the as-set-instance-health command) to set the instance's health status back to healthy, but you will get an error if the instance is already terminating." "Auto Scaling creates a new scaling activity for terminating the unhealthy instance and then terminates it. Subsequently, another scaling activity launches a new instance to replace the terminated instance."


A user has configured ELB with Auto Scaling. The user suspended the Auto Scaling terminate process only for a while. What will happen to the availability zone rebalancing process (AZRebalance) during this period?

A. Auto Scaling will not launch or terminate any instances
B. Auto Scaling will allow the instances to grow more than the maximum size
C. Auto Scaling will keep launching instances till the maximum instance size
D. It is not possible to suspend the terminate process while keeping the launch active

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/as-suspend-resume-processes.html "If you suspend Launch, AZRebalance neither launches new instances nor terminates existing instances. This is because AZRebalance terminates instances only after launching the replacement instances. If you suspend Terminate, your Auto Scaling group can grow up to ten percent larger than its maximum size, because Auto Scaling allows this temporarily during rebalancing activities. If Auto Scaling cannot terminate instances, your Auto Scaling group could remain above its maximum size until you resume the Terminate process."


An organization has configured Auto Scaling with ELB. There is a memory issue in the application which is causing CPU utilization to go above 90%. The higher CPU usage triggers an event for Auto Scaling as per the scaling policy. If the user wants to find the root cause inside the application without triggering a scaling activity, how can he achieve this?

A. Stop the scaling process until research is completed
B. It is not possible to find the root cause from that instance without triggering scaling
C. Delete Auto Scaling until research is completed
D. Suspend the scaling process until research is completed

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/as-suspend-resume-processes.html "Auto Scaling enables you to suspend and then resume one or more of the Auto Scaling processes in your Auto Scaling group. This can be very useful when you want to investigate a configuration problem or other issue with your web application and then make changes to your application, without triggering the Auto Scaling process."


A user has configured ELB with Auto Scaling. The user suspended the Auto Scaling Alarm Notification (which notifies Auto Scaling for CloudWatch alarms) process for a while. What will Auto Scaling do during this period?

A. AWS will not receive the alarms from CloudWatch
B. AWS will receive the alarms but will not execute the Auto Scaling policy
C. Auto Scaling will execute the policy but it will not launch the instances until the process is resumed
D. It is not possible to suspend the AlarmNotification process

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/as-suspend-resume-processes.html
"If you suspend AlarmNotification, Auto Scaling does not automatically execute policies that would be triggered by an alarm. If you suspend Launch or Terminate, Auto Scaling would not be able to execute scale out or scale in policies, respectively."


An organization has configured two single availability zones. The Auto Scaling groups are configured in separate zones. The user wants to merge the groups such that one group spans across multiple zones. How can the user configure this?

A. Run the command as-join-auto-scaling-group to join the two groups
B. Run the command as-update-auto-scaling-group to configure one group to span across zones and delete the other group
C. Run the command as-copy-auto-scaling-group to join the two groups
D. Run the command as-merge-auto-scaling-group to merge the groups

Why? http://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html --availability-zones (list)

One or more Availability Zones for the group.

An organization has configured Auto Scaling with ELB. One of the instance health check returns the status as Impaired to Auto Scaling. What will Auto Scaling do in this scenario?

A. Perform a health check until cool down before declaring that the instance has failed
B. Terminate the instance and launch a new instance
C. Notify the user using SNS for the failed state
D. Notify ELB to stop sending traffic to the impaired instance

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/as-maintain-instance-levels.html "If the instance status is any state other than running or if the system status is impaired, Auto Scaling considers the instance to be unhealthy and launches a replacement."


A user has setup an Auto Scaling group. The group has failed to launch a single instance for more than 24 hours. What will happen to Auto Scaling in this condition

A. Auto Scaling will keep trying to launch the instance for 72 hours
B. Auto Scaling will suspend the scaling process
C. Auto Scaling will start an instance in a separate region
D. The Auto Scaling group will be terminated automatically

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/as-suspend-resume-processes.html "Auto Scaling might suspend processes for Auto Scaling groups that repeatedly fail to launch instances. This is known as an administrative suspension, and most commonly applies to Auto Scaling groups that have been trying to launch instances for over 24 hours but have not succeeded in launching any instances. You can resume processes suspended for administrative reasons."


A user is planning to setup infrastructure on AWS for the Christmas sales. The user is planning to use Auto Scaling based on the schedule for proactive scaling. What advise would you give to the user?

A. It is good to schedule now because if the user forgets later on it will not scale up
B. The scaling should be setup only one week before Christmas
C. Wait till end of November before scheduling the activity
D. It is not advisable to use scheduled based scaling


A user is trying to setup a recurring Auto Scaling process. The user has setup one process to scale up every day at 8 am and scale down at 7 PM. The user is trying to setup another recurring process which scales up on the 1st of every month at 8 AM and scales down the same day at 7 PM. What will Auto Scaling do in this scenario

A. Auto Scaling will execute both processes but will add just one instance on the 1st
B. Auto Scaling will add two instances on the 1st of the month
C. Auto Scaling will schedule both the processes but execute only one process randomly
D. Auto Scaling will throw an error since there is a conflict in the schedule of two separate Auto Scaling Processes


A sys admin is trying to understand the Auto Scaling activities. Which of the below mentioned processes is not performed by Auto Scaling?

A. Reboot Instance
B. Schedule Actions
C. Replace Unhealthy
D. Availability Zone Re-Balancing


You have started a new job and are reviewing your company’s infrastructure on AWS. You notice one web application where they have an Elastic Load Balancer in front of web instances in an Auto Scaling Group. When you check the metrics for the ELB in CloudWatch you see four healthy instances In Availability Zone (AZ) A and zero in AZ B there are zero unhealthy instances. What do you need to fix to balance the instances across AZs?

A. Set the ELB to only be attached to another AZ
B. Make sure Auto Scaling is configured to launch in both AZs
C. Make sure your AMI is available in both AZs
D. Make sure the maximum size of the Auto Scaling Group is greater than 4


You have been asked to leverage Amazon VPC EC2 and SQS to implement an application that submits and receives millions of messages per second to a message queue. You want to ensure your application has sufficient bandwidth between your EC2 instances and SQS. Which option will provide the most scalable solution for communicating between the application and SQS?

A. Ensure the application instances are properly configured with an Elastic Load Balancer
B. Ensure the application instances are launched in private subnets with the EBS-optimized option enabled
C. Ensure the application instances are launched in public subnets with the associate-public-IP-address=trueoption enabled
D. Launch application instances in private subnets with an Auto Scaling group and Auto Scaling triggers configured to watch the SQS queue size


You have decided to change the Instance type for instances running In your application tier that are using Auto Scaling. In which area below would you change the instance type definition?

A. Auto Scaling launch configuration
B. Auto Scaling group
C. Auto Scaling policy
D. Auto Scaling tags

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/create-launch-config.html "When you create a launch configuration, you must specify information about the EC2 instances to launch, such as the Amazon Machine Image (AMI), instance type, key pair, security groups, and block device mapping."


A user is trying to delete an Auto Scaling group from CLI. Which of the below mentioned steps are to be performed by the user?

A. Terminate the instances with the ec2-terminate-instance command
B. Terminate the Auto Scaling instances with the as-terminate-instance command
C. Set the minimum size and desired capacity to 0
D. There is no need to change the capacity. Run the as-delete-group command and it will reset all values to 0


A user has created a web application with Auto Scaling. The user is regularly monitoring the application and he observed that the traffic is highest on Thursday and Friday between 8 AM to 6 PM. What is the best solution to handle scaling in this case?

A. Add a new instance manually by 8 AM Thursday and terminate the same by 6 PM Friday
B. Schedule Auto Scaling to scale up by 8 AM Thursday and scale down after 6 PM on Friday
C. Schedule a policy which may scale up every day at 8 AM and scales down by 6 PM
D. Configure a batch process to add a instance by 8 AM and remove it by Friday 6 PM


A user has configured the Auto Scaling group with the minimum capacity as 3 and the maximum capacity as 5. When the user configures the AS group, how many instances will Auto Scaling launch?

A. 3
B. 0
C. 5
D. 2


A sys admin is maintaining an application on AWS. The application is installed on EC2 and user has configured ELB and Auto Scaling. Considering future load increase, the user is planning to launch new servers proactively so that they get registered with ELB. How can the user add these instances with Auto Scaling?

A. Increase the desired capacity of the Auto Scaling group
B. Increase the maximum limit of the Auto Scaling group
C. Launch an instance manually and register it with ELB on the fly
D. Decrease the minimum limit of the Auto Scaling group



You have decided to change the instance type for instances running in your application tier that is using Auto Scaling. In which area below would you change the instance type definition?

A. Auto Scaling policy
B. Auto Scaling group
C. Auto Scaling tags
D. Auto Scaling launch configuration

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/create-launch-config.html "When you create a launch configuration, you must specify information about the EC2 instances to launch, such as the Amazon Machine Image (AMI), instance type, key pair, security groups, and block device mapping."


An Auto-Scaling group spans 3 AZs and currently has 4 running EC2 instances. When Auto Scaling needs to terminate an EC2 instance by default, AutoScaling will: Choose 2 answers

A. Allow at least five minutes for Windows/Linux shutdown scripts to complete, before terminating the instance.
B. Terminate the instance with the least active network connections. If multiple instances meet this criterion, one will be randomly selected.
C. Send an SNS notification, if configured to do so.
D. Terminate an instance in the AZ which currently has 2 running EC2 instances.
E. Randomly select one of the 3 AZs, and then terminate an instance in that AZ.

Why? http://docs.aws.amazon.com/autoscaling/latest/userguide/as-instance-termination.html#default-termination-policy "If so, it selects the Availability Zone with the most instances and at least one instance that is not protected from scale in."

AWS SAA Study List - RDS

RDS

Basics

• Managed service (no SSH)
• Supports Multi-AZ configurations
• Supports MySQL, MariaDB, AuroraDB, Postgres, Oracle and MSSQL
• Parameters of DB Instances are handled by parameter file (think Oracle spfile)
• Offers automated backups
• Backup storage for active databases is free
• Databases can be restored within 5 minute timeframe (transaction logs are taken often)
• Price is based on data in or out of your RDS into Internet (inside AWS free)

Limits

• Storage limited from 5GB to 6TB
• Backup window from 0 to 35

Following topics are exam questions collected through Internet and should be evaluated as so. Answers are mine and have been checked with answers collected through the internet, but might still be wrong.


Your company is getting ready to do a major public announcement of a social media site on AWS. The website is running on EC2 instances deployed across multiple Availability Zones with a Multi-AZ RDS MySQL Extra Large DB Instance. The site performs a high number of small reads and writes per second and relies on an eventual consistency model. After comprehensive tests you discover that there is read contention on RDS MySQL. Which are the best approaches to meet these requirements? (Choose 2 answers)

A. Deploy ElasticCache in-memory cache running in each availability zone
B. Implement sharding to distribute load to multiple RDS MySQL instances
C. Increase the RDS MySQL Instance size and Implement provisioned IOPS
D. Add an RDS MySQL read replica in each availability zone

Why? 'read contention' is the keyword, hence A and D are only ones which fullfil this requirement



A company is running a batch analysis every hour on their main transactional DB running on an RDS MySQL instance to populate their central Data Warehouse running on Redshift. During the execution of the batch their transactional applications are very slow. When the batch completes they need to update the top management dashboard with the new data. The dashboard is produced by another system running on-premises that is currently started when a manually-sent email notifies that an update is required. The on-premises system cannot be modified because is managed by another team. How would you optimize this scenario to solve performance issues and automate the process as much as possible?

A. Replace RDS with Redshift for the batch analysis and SNS to notify the on-premises system to update the dashboard
B. Replace RDS with Redshift for the batch analysis and SQS to send a message to the on-premises system to update the dashboard
C. Create an RDS Read Replica for the batch analysis and SNS to notify me on-premises system to update the dashboard
D. Create an RDS Read Replica for the batch analysis and SQS to send a message to the on-premises system to update the dashboard.

Why? Ruling out the SQS options first, leaves us A and C. Read replica would solve the case easiest, hence C.



Will my standby RDS instance be in the same Availability Zone as my primary?
A. Only for Oracle RDS types
B. Yes
C. Only if configured at launch
D. No

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html "In a Multi-AZ deployment, Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone."



Is creating a Read Replica of another Read Replica supported?
A. Only in certain regions
B. Only with MySQL based RDS
C. Only for Oracle RDS types
D. No

Why? https://aws.amazon.com/about-aws/whats-new/2013/08/28/amazon-rds-read-replica-new-features/ "Create a replica from an existing Read Replica (supported for MySQL 5.6) - You can now create a second-tier Read Replica from an existing first-tier Read Replica."



A user is planning to set up the Multi-AZ feature of RDS. Which of the below mentioned conditions won’t take advantage of the Multi-AZ feature?
A. Availability zone outage
B. A manual failover of the DB instance using Reboot with failover option
C. Region outage
D. When the user changes the DB instance’s server type

Why? Multi-AZ uses the same region, hence if the region goes down, all the AZ's go down as well.



When you run a DB Instance as a Multi-AZ deployment, the “_____” serves database writes and reads
A. Secondary
B. backup
C. stand by
D. primary

Why? Primary database is the starting point always.



When running my DB Instance as a Multi-AZ deployment, can I use the standby for read or write operations?
A. Yes
B. Only with MSSQL based RDS
C. Only for Oracle RDS instances
D. No

Why? Standby databases can't be used for write operations at all, no matter which technology.



Read Replicas require a transactional storage engine and are only supported for the _________ storage engine
A. OracleISAM
B. MSSQLDB
C. InnoDB
D. MyISAM

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html "Replication is only supported for the InnoDB storage engine on MySQL and the XtraDB storage engine on MariaDB."



A user is configuring the Multi AZ feature of an RDS DB. The user came to know that this RDS DB does not use the AWS technology, but uses server mirroring to achieve replication. Which DB is the user using right now?
A. MySQL
B. Oracle
C. MSSQL
D. PostgreSQL

Why? https://msdn.microsoft.com/en-us/library/ms189852.aspx Database Mirroring (SQL Server)



If I have multiple Read Replicas for my master DB Instance and I promote one of them, what happens to the rest of the Read Replicas?
A. The remaining Read Replicas will still replicate from the older master DB Instance
B. The remaining Read Replicas will be deleted
C. The remaining Read Replicas will be combined to one read replica

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html "If you promote a MySQL or MariaDB Read Replica that is in turn replicating to other Read Replicas, those Read Replicas remain active. Consider an example where MyDBInstance1 replicates to MyDBInstance2, and MyDBInstance2 replicates to MyDBInstance3. If you promote MyDBInstance2, replication from MyDBInstance1 to MyDBInstance2 no longer occurs, but MyDBInstance2 still replicates to MyDBInstance3."



If you have chosen Multi-AZ deployment, in the event of a planned or unplanned outage of your primary DB Instance, Amazon RDS automatically switches to the standby replica. The automatic failover mechanism simply changes the ______ record of the main DB Instance to point to the standby DB Instance.
A. DNAME
B. CNAME
C. TXT
D. MX

Why? https://aws.amazon.com/blogs/aws/amazon-rds-multi-az-deployment/ "The CNAME record for your DB instance will be altered to point to the newly promoted standby."



When automatic failover occurs, Amazon RDS will emit a DB Instance event to inform you that automatic failover occurred. You can use the _____ to return information about events related to your DB Instance
A. FetchFailure
B. DescribeFailure
C. DescribeEvents
D. FetchEvents

Why? http://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEvents.html "Returns events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days. Events specific to a particular DB instance, DB security group, database snapshot, or DB parameter group can be obtained by providing the name as a parameter. By default, the past hour of events are returned."


The new DB Instance that is created when you promote a Read Replica retains the backup window period.
A. TRUE
B. FALSE

Why? http://docs.aws.amazon.com/AmazonRDS/latest/CommandLineReference/CLIReference-cmd-PromoteRead.html "We recommend that you enable automated backups on your Read Replica before promoting the Read Replica. This ensures that no backup is taken during the promotion process. Once the instance is promoted to a primary instance, backups are taken based on your backup settings."



Will I be alerted when automatic failover occurs?
A. Only if SNS configured
B. No
C. Yes
D. Only if Cloudwatch configured

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html "DB event subscriptions can be setup to notify you via email or SMS that a failover has been initiated. For more information about events, see Using Amazon RDS Event Notification"



Can I initiate a “forced failover” for my MySQL Multi-AZ DB Instance deployment?
A. Only in certain regions
B. Only in VPC
C. Yes
D. No

Why? Yes, of course no matter of region or VPC configuration.


A user is accessing RDS from an application. The user has enabled the Multi-AZ feature with the MS SQL RDS DB. During a planned outage how will AWS ensure that a switch from DB to a standby replica will not affect access to the application?
A. RDS will have an internal IP which will redirect all requests to the new DB
B. RDS uses DNS to switch over to standby replica for seamless transition
C. The switch over changes hardware so RDS does not need to worry about access
D. RDS will have both the DBs running independently and the user has to manually switch over

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html "The primary DB instance switches over automatically to the standby replica if any of the following conditions occur: The operating system of the DB instance is undergoing software patching"



Which of the following is part of the failover process for a Multi-Availability Zone Amazon Relational Database Service (RDS) instance?
A. The failed RDS DB instance reboots.
B. The IP of the primary DB instance is switched to the standby DB instance.
C. The DNS record for the RDS endpoint is changed from primary to standby.
D. A new DB instance is created in the standby availability zone.

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html "The failover mechanism automatically changes the DNS record of the DB instance to point to the standby DB instance."


True or False: When you perform a restore operation to a point in time or from a DB Snapshot, a new DB Instance is created with a new endpoint.

A. FALSE
B. TRUE

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RestoreFromSnapshot.html "You cannot restore from a DB snapshot to an existing DB instance; a new DB instance is created when you restore."


Because of the extensibility limitations of striped storage attached to Windows Server, Amazon RDS does not currently support increasing storage on a DB Instance.

A. SQL Server
B. MySQL
C. Oracle

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html "Because of the extensibility limitations of striped storage attached to Windows Server, Amazon RDS does not currently support increasing storage on a SQL Server DB Instance."


If I modify a DB Instance or the DB parameter group associated with the instance, should I
reboot the instance for the changes to take effect?

A. No
B. Yes

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RebootInstance.html "In some cases, if you modify a DB instance, change the DB parameter group associated with the instance, or change a static DB parameter in a parameter group the instances uses, you must reboot the instance for the changes to take effect."


A company is deploying a new two-tier web application in AWS. The company has limited staff and requires high availability, and the application requires complex queries and table joins. Which configuration provides the solution for the company’s requirements?

A. MySQL Installed on two Amazon EC2 Instances in a single Availability Zone
B. Amazon RDS for MySQL with Multi-AZ
C. Amazon ElastiCache
D. Amazon DynamoDB

Why? B instead of A, as "limited staff" is mentioned and RDS is fully managed service. Complex queries and table joins point to RDS.


You are running a successful multitier web application on AWS and your marketing department has asked you to add a reporting tier to the application. The reporting tier will aggregate and publish status reports every 30 minutes from user-generated information that is being stored in your web application s database. You are currently running a Multi-AZ RDS MySQL instance for the database tier. You also have implemented Elasticache as a database caching layer between the application tier and database tier. Please select the answer that will allow you to successfully implement the reporting tier with as little impact as possible to your database.

A. Continually send transaction logs from your master database to an S3 bucket and generate the reports off the S3 bucket using S3 byte range requests.
B. Generate the reports by querying the synchronously replicated standby RDS MySQL instance maintained through Multi-AZ.
C. Launch a RDS Read Replica connected to your Multi AZ master database and generate reports by querying the Read Replica.
D. Generate the reports by querying the ElastiCache database caching tier.

Why? MySQL supports Read Replica, which provides readable database for realtime reporting.


Will my standby RDS instance be in the same Region as my primary?

A. Only for Oracle RDS types
B. Yes
C. Only if configured at launch
D. No

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html "In a Multi-AZ deployment, Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone."


True or False: When using IAM to control access to your RDS resources, the key names that can be used are case sensitive. For example, aws:CurrentTime is NOT equivalent to AWS:currenttime.

A. TRUE
B. FALSE

Why http://docs.aws.amazon.com/directconnect/latest/UserGuide/using_iam.html "Key names are case-insensitive. For example, aws:CurrentTime is equivalent to AWS:currenttime."

http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html "The name must match an action that is supported by the service. The prefix and the action name are case insensitive. For example, iam:ListAccessKeys is the same as IAM:listaccesskeys."


True or False: Automated backups are enabled by default for a new DB Instance.

A. TRUE
B. FALSE

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.BackingUpAndRestoringAmazonRDSInstances.html "Automated backup is an Amazon RDS feature that automatically creates a backup of your DB instance. Automated backups are enabled by default for a new DB instance."


Amazon RDS automated backups and DB Snapshots are currently supported for only the __________ storage engine

A. InnoDB
B. MyISAM

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.BackingUpAndRestoringAmazonRDSInstances.html "Amazon RDS automated backups and DB snapshots are currently supported for all DB engines. For the MySQL DB engine, only the InnoDB storage engine is supported; use of these features with other MySQL storage engines, including MyISAM, may lead to unreliable behavior while restoring from backups."


Typically, you want your application to check whether a request generated an error before you spend any time processing results. The easiest way to find out if an error occurred is to look for an __________ node in the response from the Amazon RDS API.

A. Incorrect
B. Error
C. FALSE

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/APITroubleshooting.html "Typically, you want your application to check whether a request generated an error before you spend any time processing results. The easiest way to find out if an error occurred is to look for an Error node in the response from the Amazon RDS API."

In the Amazon CloudWatch, which metric should I be checking to ensure that your DB Instance has enough free storage space?

A. FreeStorage
B. FreeStorageSpace
C. FreeStorageVolume
D. FreeDBStorageSpace

Why? http://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/rds-metricscollected.html "FreeStorageSpace The amount of available storage space."


Amazon RDS DB snapshots and automated backups are stored in

A. Amazon S3
B. Amazon ECS Volume
C. Amazon RDS
D. Amazon EMR

Why? https://aws.amazon.com/rds/faqs/ "Where are my automated backups and DB Snapshots stored and how do I manage their retention?: Amazon RDS DB snapshots and automated backups are stored in S3."


You must increase DB storage size in increments of at least _____ %

A. 40
B. 20
C. 50
D. 10

Why? http://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBInstance.html "AllocatedStorage Constraints: Value supplied must be at least 10% greater than the current value."


Changes to the backup window take effect ______.

A. from the next billing cycle
B. after 30 minutes
C. immediately
D. after 24 hours

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.BackingUpAndRestoringAmazonRDSInstances.html "Changes to the backup window take effect immediately. The backup window cannot overlap with the weekly maintenance window for the DB instance."


What are the two types of licensing options available for using Amazon RDS for Oracle?

A. BYOL and Enterprise License
B. BYOL and License Included
C. Enterprise License and License Included
D. Role based License and License Included

Why? https://aws.amazon.com/rds/oracle/ "You can run Amazon RDS for Oracle under two different licensing models – “License Included” and “Bring-Your-Own-License (BYOL)”."


Disabling automated backups ______ disable the point-in-time recovery.

A. if configured to can
B. will never
C. will

Why? This doesn't need explaining


True or False: Manually created DB Snapshots are deleted after the DB Instance is deleted.

A. TRUE
B. FALSE

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html "Manual DB snapshots of the instance are not deleted."


Is Federated Storage Engine currently supported by Amazon RDS for MySQL?

A. Only for Oracle RDS instances
B. No
C. Yes
D. Only in VPC

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_MySQL.html "The Federated Storage Engine is currently not supported by Amazon RDS for MySQL."


What happens to the I/O operations while you take a database snapshot?

A. I/O operations to the database are suspended for a few minutes while the backup is in progress.
B. I/O operations to the database are sent to a Replica (if available) for a few minutes while the backup is in  progress.
C. I/O operations will be functioning normally
D. I/O operations to the database are suspended for an hour while the backup is in progress

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CreateSnapshot.html "Creating this DB snapshot on a Single-AZ DB instance results in a brief I/O suspension that typically lasting no more than a few minutes."


When should I choose Provisioned IOPS over Standard RDS storage?

A. If you have batch-oriented workloads
B. If you use production online transaction processing (OLTP) workloads.
C. If you have workloads that are not sensitive to consistent performance

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html "Provisioned IOPS storage is designed to meet the needs of I/O-intensive workloads, particularly database workloads, that are sensitive to storage performance and consistency in random access I/O throughput."

True or False: If you add a tag that has the same key as an existing tag on a DB Instance, the new value overwrites the old value.

A. FALSE
B. TRUE


Why? http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html "If you add a tag that has the same key as an existing tag on that resource, the new value overwrites the old value."


Are Reserved Instances available for Multi-AZ Deployments?

A. Only for Cluster Compute instances
B. Yes for all instance types
C. Only for M3 instance types
D. No

Why? https://aws.amazon.com/rds/faqs/ "Are Reserved Instances available for Multi-AZ Deployments?: Yes. When you call the DescribeReservedDBInstancesOfferings API or describe-reserved-db-instances-offerings command, simply look for the Multi-AZ options listed among the DB Instance configurations available for purchase. If you want to purchase a reservation for a DB Instance with synchronous replication across multiple Availability Zones, specify one of these offerings in your PurchaseReservedDBInstancesOffering call."

When automatic failover occurs, Amazon RDS will emit a DB Instance event to inform you that automatic failover occurred. You can use the _____ to return information about events related to your DB Instance

A. FetchFailure
B. DescribeFailure
C. DescribeEvents
D. FetchEvents

Why? https://aws.amazon.com/rds/faqs/ "Q: Will I be alerted when automatic failover occurs?: Yes, Amazon RDS will emit a DB Instance event to inform you that automatic failover occurred. You can click the “Events” section of the Amazon RDS Console or use the DescribeEvents API to return information about events related to your DB Instance. You can also use Amazon RDS Event Notifications to be notified when specific DB events occur."


Is the SQL Server Audit feature supported in the Amazon RDS SQL Server engine?

A. No
B. Yes

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html
Amazon RDS currently does not support the following SQL Server features: SQL Server Audit


If your DB instance runs out of storage space or file system resources, its status will change to_____ and your DB Instance will no longer be available.

A. storage-overflow
B. storage-full
C. storage-exceed
D. storage-overage

Why? https://aws.amazon.com/ko/premiumsupport/knowledge-center/rds-out-of-storage/ "When an RDS DB instance reaches the STORAGE_FULL state, there is not enough space available for performing basic operations, eventually preventing you to make connections or restart the instance."


Does Amazon RDS for SQL Server currently support importing data into the msdb database?

A. No
B. Yes

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html "Amazon RDS for SQL Server does not support importing data into the msdb database."


Is decreasing the storage size of a DB Instance permitted?

A. Depends on the RDMS used
B. Yes
C. No

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#CHAP_Storage.FactsAbout "You cannot decrease storage allocated for a DB instance."


In the context of MySQL, version numbers are organized as MySQL version = X.Y.Z. What does X denote here?

A. release level
B. minor version
C. version number
D. major version

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_MySQL.html "MySQL, version numbers are organized as version = X.Y.Z. In Amazon RDS terminology, X.Y denotes the major version, and Z is the minor version number."


Do the system resources on the Micro instance meet the recommended configuration for Oracle?

A. Yes completely
B. Yes but only for certain situations
C. Not in any circumstance

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html#Concepts.DBInstanceClass.Previous "Micro Instances (db.t1.micro) are instances sufficient for testing that should not be used for production applications. Using a db.t1.micro instance with Oracle is a limited test configuration. If you want to use a micro DB instance class, the db.t1.micro DB instance class only supports Oracle versions 11.2.0.2, 11.2.0.3, and 12.1.0.1. PostgreSQL version 9.5.2 does not support this instance class."


True or False: When you add a rule to a DB security group, you do not need to specify port number or protocol.

A. Depends on the RDMS used
B. TRUE
C. FALSE

http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html
"You do not need to specify a destination port number when you create DB security group rules; the port number defined for the DB instance is used as the destination port number for all rules defined for the DB security group."


Amazon RDS creates an SSL certificate and installs the certificate on the DB Instance when Amazon RDS provisions the instance. These certificates are signed by a certificate authority. The _____ is stored at https://rds.amazonaws.com/doc/rds-ssl-ca-cert.pem.

A. private key
B. foreign key
C. public key
D. protected key

Why? https://aws.amazon.com/blogs/aws/amazon-rds-sql-server-ssl-support/ "Download a public certificate key from RDS at https://rds.amazonaws.com/doc/rds-ssl-ca-cert.pem"


If I scale the storage capacity provisioned to my DB Instance by mid of a billing month, how will I be charged?

A. You will be charged for the highest storage capacity you have used
B. On a proration basis
C. You will be charged for the lowest storage capacity you have used

Why? https://aws.amazon.com/rds/faqs/ "Storage (per GB per month) – Storage capacity you have provisioned to your DB Instance. If you scale your provisioned storage capacity within the month, your bill will be pro-rated."

Amazon RDS supports SOAP only through __________.

A. HTTP or HTTPS
B. TCP/IP
C. HTTP
D. HTTPS

Why? http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/using-soap-api.html "Amazon RDS supports SOAP only through HTTPS."


A company wants to implement their website in a virtual private cloud (VPC). The web tier will use an Auto Scaling group across multiple Availability Zones (AZs). The database will use Multi-AZ RDS MySQL and should not be publicly accessible. What is the minimum number of subnets that need to be configured in the VPC?

A. 1
B. 2
C. 3
D. 4

Why? You can have your Web servers in two VPC's and configure the RDS servers to use those as well. You just need to configure RDS to be "not publicly accessible" to fullfil the needs of this scenario.