A company with dozens of AWS accounts wants to ensure that governance rules are being applied across all accounts. The CIO has recommended that AWS Config rules be deployed using an AWS CloudFormation template. How should these requirements be met?

• A.Create a CloudFormation stack in the master account of AWS Organizations and execute the CloudFormation template to create AWS Config rules in all accounts
• B.Write a script that iterates over the company's AWS accounts and executes the CloudFormation template in each account
• C.Use AWS Organizations to execute the CloudFormation template in all accounts
• D.Create a CloudFormation stack set, then select the CloudFormation template and use it to configure the AWS accounts

Comment: *

Name: *

Email: *

Verification: *

A SysOps Administrator is deploying a legacy web application on AWS. The application has four Amazon EC2 instances behind Classic Load Balancer and stores data in an Amazon RDS instance. The legacy application has known vulnerabilities to SQL injection attacks, but the application code is no longer available to update.
What cost-effective configuration change should the Administrator make to migrate the risk of SQL injection attacks?

• A.Configure Amazon GuardDuty to monitor the application for SQL injection threats.
• B.Configure AWS WAF with a Classic Load Balancer for protection against SQL injection attacks.
• C.Replace the Classic Load Balancer with an Application Load Balancer and configure AWS WAF on the Application Load Balancer.
• D.Configure an Amazon CloudFront distribution with the Classic Load Balancer as the origin and subscribe to AWS Shield Standard.

Comment: *

Name: *

Email: *

Verification: *

An organization is using cost allocation tags to find the cost distribution of different departments and projects.
One of the instances has two separate tags with the key/ value as "InstanceName/HR", "CostCenter/HR".
What will AWS do in this case?

• A.InstanceName is a reserved tag for AWS. Thus, AWS will not allow this tag
• B.AWS will not allow the tags as the value is the same for different keys
• C.AWS will allow tags but will not show correctly in the cost allocation report due to the same value of the two separate keys
• D.AWS will allow both the tags and show properly in the cost distribution report

Comment: *

Name: *

Email: *

Verification: *

An Amazon EC2 instance is unable to connect an SMTP server in a different subnet. Other instances are successfully communicating with the SMTP server, however VPC Flow Logs have been enabled on the SMTP server's network interface and show the following information:
2 223342798652 eni-abe77dab 10.1.1.200 10.100.1.10 1123 25 17 70 48252 1515534437 1515535037 REJECT OK What can be done to correct this problem?

• A.Add the instance to the security group for the SMTP server and ensure that is permitted to communicate over TCP port 25.
• B.Disable the iptables service on the SMTP server so that the instance can properly communicate over the network.
• C.Add a rule to the security group for the instance to explicitly permit TCP port 25 outbound to any address.
• D.Install an email client on the instance to ensure that it communicates correctly on TCP port 25 to the SMTP server.

Comment: *

Name: *

Email: *

Verification: *

An organization has created one IAM user and applied the below mentioned policy to the user. What entitlements do the IAM users avail with this policy?

• A.The policy will allow the user to perform all read only activities on the EC2 services
• B.The policy will allow the user to list all the EC2 resources except EBS
• C.The policy will allow the user to perform all read and write activities on the EC2 services
• D.The policy will allow the user to perform all read only activities on the EC2 services except loadBalancing

Correct Answer: D

Explanation
AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. If an organization wants to setup read only access to EC2 for a particular user, they should mention the action in the IAM policy which entitles the user for Describe rights for EC2, CloudWatch, Auto Scaling and ELB. In the policy shown below, the user will have read only access for EC2 and EBS, CloudWatch and Auto Scaling. Since ELB is not mentioned as a part of the list, the user will not have access to ELB.

Comment: *

Name: *

Email: *

Verification: *