You run accounting software in the AWS cloud. This software needs to be online continuously during the day every day of the week, and has a very static requirement for compute resources.
You also have other, unrelated batch jobs that need to run once per day at any time of your choosing. How should you minimize cost?

• A.Purchase a Heavy Utilization Reserved Instance to run the accounting software. Turn it off after hours.
  Run the batch jobs with the same instance class, so the Reserved Instance credits are also applied to the batch jobs.
• B.Purchase a Medium Utilization Reserved Instance to run the accounting software. Turn it off after hours.
  Run the batch jobs with the same instance class, so the Reserved Instance credits are also applied to the batch jobs.
• C.Purchase a Light Utilization Reserved Instance to run the accounting software. Turn it off after hours.
  Run the batch jobs with the same instance class, so the Reserved Instance credits are also applied to the batch jobs.
• D.Purchase a Full Utilization Reserved Instance to run the accounting software. Turn it off after hours.
  Run the batch jobs with the same instance class, so the Reserved Instance credits are also applied to the batch jobs.

Comment: *

Name: *

Email: *

Verification: *

A DevOps Engineer has been asked to recommend a tool to deploy the components of a threetier web application. This application will use Amazon DynamoDB as a database Which deployment requires the LEAST amount of operational management?

• A.Use AWS CloudFormation to create a Classic Load Balancer and an Auto Scaling group. Use AWS OpsWorks to create the application and database resources Deploy application updates with OpsWorks using lifecycle events
• B.Use AWS OpsWorks to create a Classic Load Balancer Auto Scaling and application resources Use AWS CloudFormation to create the database resources Deploy application updates using CloudFormation rolling updates
• C.Use AWS CloudFormation to create a Classic Load Balancer an Auto Scaling group and database resources Deploy application updates using CloudFormation rolling updates
• D.Use AWS OpsWorks to create a Classic Load Balancer, an Auto Scaling group application, and database resources Deploy application updates using OpsWorks lifecycle events

Comment: *

Name: *

Email: *

Verification: *

Your application is currently running on Amazon EC2 instances behind a load balancer. Your management has decided to use a Blue/Green deployment strategy. How should you implement this for each deployment?

• A.Set up Amazon Route 53 health checks to fail over from any Amazon EC2 instance that is currently being deployed to.
• B.Using AWS CloudFormation, create a test stack for validating the code, and then deploy the code to each production Amazon EC2 instance.
• C.Create a new load balancer with new Amazon EC2 instances, carry out the deployment, and then switch DNS over to the new load balancer using Amazon Route 53 after testing.
• D.Launch more Amazon EC2 instances to ensure high availability, de-register each Amazon EC2 instance from the load balancer, upgrade it, and test it, and then register it again with the load balancer.

Correct Answer: C

The below diagram shows how this can be done

1) First create a new ELB which will be used to point to the new production changes.
2) Use the Weighted Route policy for Route53 to distribute the traffic to the 2 ELB's based on a 80-20% traffic scenario. This is the normal case, the % can be changed based on the requirement.
3) Finally when all changes have been tested, Route53 can be set to 100% for the new ELB.
Option A is incorrect because this is a failover scenario and cannot be used for Blue green deployments. In Blue Green deployments, you need to have 2 environments running side by side.
Option B is incorrect, because you need to a have a production stack with the changes which will run side by side.
Option D is incorrect because this is not a blue green deployment scenario. You cannot control which users will go the new EC2 instances.
For more information on blue green deployments, please refer to the below document link: from AWS
https://dOawsstatic.com/whitepapers/AWS_Blue_Green_Deployments.pdf

Comment: *

Name: *

Email: *

Verification: *

A consulting company was hired to assess security vulnerabilities within a client company's application and propose a plan to remediate all identified issues. The architecture is identified as follows: Amazon S3 storage for content, an Auto Scaling group of Amazon EC2 instances behind an Elastic Load Balancer with attached Amazon EBS storage, and an Amazon RDS MySQL database. There are also several AWS Lambda functions that communicate directly with the RDS database using connection string statements in the code.
The consultants identified the top security threat as follows: the application is not meeting its requirement to have encryption at rest.
What solution will address this issue with the LEAST operational overhead and will provide monitoring for potential future violations?

• A.Enable SSE encryption on the S3 buckets and RDS database. Enable OS-based encryption of data on EBS volumes. Configure Amazon Inspector agents on EC2 instances to report on insecure encryption ciphers.
  Set up AWS Config rules to periodically check for non-encrypted S3 objects.
• B.Enable Secure Sockets Layer (SSL) on the load balancer, ensure that AWS Lambda is using SSL to communicate to the RDS database, and enable S3 encryption. Configure the application to force SSL for incoming connections and configure RDS to only grant access if the session is encrypted. Configure Amazon Inspector agents on EC2 instances to report on insecure encryption ciphers.
• C.Configure the application to encrypt each file prior to storing on Amazon S3. Enable OS-based encryption of data on EBS volumes. Encrypt data on write to RDS. Run cron jobs on each instance to check for encrypted data and notify via Amazon SNS. Use S3 Events to call an AWS Lambda function and verify if the file is encrypted.
• D.Enable SSE encryption on the S3 buckets, EBS volumes, and the RDS database. Store RDS credentials in EC2 Parameter Store. Enable a policy on the S3 bucket to deny unencrypted puts. Set up AWS Config rules to periodically check for non-encrypted S3 objects and EBS volumes, and to ensure that RDS storage is encrypted.

Comment: *

Name: *

Email: *

Verification: *

You are planning on using the Amazon RDS facility for Fault tolerance for your application. How does
Amazon RDSmuIti Availability Zone model work

• A.A second, standby database is deployed and maintained in a different availability zone from master,
  using synchronous replication.
• B.A second, standby database is deployed and maintained in a different availability zone from master
  using asynchronous replication.
• C.A second, standby database is deployed and maintained in a different region from master using
  asynchronous replication.
• D.A second, standby database is deployed and maintained in a different region from master using
  synchronous replication.

Correct Answer: A

Explanation
Amazon RDS Multi-AZ deployments provide enhanced availability and durability for Database (DB)
Instances, making them a natural fit for production database
workloads. When you provision a Multi-AZ DB Instance, Amazon RDS automatically creates a primary DB
Instance and synchronously replicates the data to a
standby instance in a different Availability Zone (AZ). Cach AZ runs on its own physically distinct,
independent infrastructure, and is engineered to be highly reliable.
In case of an infrastructure failure, Amazon RDS performs an automatic failover to the standby (or to a read
replica in the case of Amazon Aurora), so that you can
resume database operations as soon as the failover is complete.
The below diagram from the AWS documentation shows how this is configured

Option B is invalid because the replication is synchronous.
Option C and D are invalid because this is built around AZ and not regions.
For more information on Multi-AZ RDS, please visit the below URL:
* https://aws.amazon.com/rds/details/multi-az/

Comment: *

Name: *

Email: *

Verification: *