NEW QUESTION 1
You are building out a layer in a software stack on AWS that needs to be able to scale out to react to increased demand as fast as possible. You are running the code on EC2 instances in an Auto Scaling Group behind an ELB. Which application code deployment method should you use?

• A. SSH into new instances that come online, and deploy new code onto the system by pulling it from an S3 bucket, which is populated by code that you refresh from source control on new pushes.
• B. Bake an AMI when deploying new versions of code, and use that AMI for the Auto Scaling Launch Configuration.
• C. Create a Dockerfile when preparing to deploy a new version to production and publish it to S3. Use UserData in the Auto Scaling Launch configuration to pull down the Dockerfile from S3 and run it when new instances launch.
• D. Create a new Auto Scaling Launch Configuration with UserData scripts configured to pull the latest code at all times.

Answer: B

Explanation:
the bootstrapping process can be slower if you have a complex application or multiple applications to install. Managing a fileet of applications with several build tools and dependencies can be a challenging task during rollouts. Furthermore, your deployment service should be designed to do faster rollouts to take advantage of Auto Scaling.
Reference: https://d0.awsstatic.com/whitepapers/overview-of-deployment-options-on-aws.pdf

NEW QUESTION 2
For AWS CloudFormation, which is true?

• A. Custom resources using SNS have a default timeout of 3 minutes.
• B. Custom resources using SNS do not need a <code>ServiceToken</code> property.
• C. Custom resources using Lambda and <code>Code.ZipFiIe</code> allow inline nodejs resource composition.
• D. Custom resources using Lambda do not need a <code>ServiceToken</code>property

Answer: C

Explanation:
Code is a property of the AWS::Lambda::Function resource that enables to you specify the source code of an AWS Lambda (Lambda) function. You can point to a file in an Amazon Simple Storage Service (Amazon S3) bucket or specify your source code as inline text (for nodejs runtime environments only). Reference:
http://docs.aws.amazon.com/AWSCIoudFormation/latest/UserGuide/template-custom-resources.html

NEW QUESTION 3
You need to deploy an AWS stack in a repeatable manner across multiple environments. You have selected CIoudFormation as the right tool to accomplish this, but have found that there is a resource type you need to create and model, but is unsupported by CIoudFormation. How should you overcome this chaHenge?

• A. Use a CIoudFormation Custom Resource Template by selecting an API call to proxy for create, update, and delete action
• B. CIoudFormation will use the AWS SDK, CLI, or API method of your choosing as the state transition function for the resource type you are modeling.
• C. Submit a ticket to the AWS Forum
• D. AWS extends CIoudFormation Resource Types by releasing tooling to the AWS Labs organization on GitHu
• E. Their response time is usually 1 day, and they complete requests within a week or two.
• F. Instead of depending on CIoudFormation, use Chef, Puppet, or Ansible to author Heat templates, which are declarative stack resource definitions that operate over the OpenStack hypervisor and cloud environment.
• G. Create a CIoudFormation Custom Resource Type by implementing create, update, and delete functionality, either by subscribing a Custom Resource Provider to an SNS topic, or by implementing the logic in AWS Lambda.

Answer: D

Explanation:
Custom resources provide a way for you to write custom provisioning logic in AWS CIoudFormation template and have AWS CIoudFormation run it during a stack operation, such as when you create, update or delete a stack. For more information, see Custom Resources.
Reference:
http://docs.aws.amazon.com/AWSCIoudFormation/latest/UserGuide/template-custom-resources.html

NEW QUESTION 4
You need to know when you spend $1000 or more on AWS. What's the easy way for you to see that notification?

• A. AWS CIoudWatch Events tied to API calls, when certain thresholds are exceeded, publish to SNS.
• B. Scrape the billing page periodically and pump into Kinesis.
• C. AWS CIoudWatch Metrics + Billing Alarm + Lambda event subscriptio
• D. When a threshold is exceeded, email the manager.
• E. Scrape the billing page periodically and publish to SN

Answer: C

Explanation:
Even if you're careful to stay within the free tier, it's a good idea to create a billing alarm to notify you if you exceed the limits of the free tier. Billing alarms can help to protect you against unknowingly accruing charges if you inadvertently use a service outside of the free tier or if traffic exceeds your expectations. Reference: http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/free-tier-aIarms.htmI

NEW QUESTION 5
When thinking of AWS OpsWorks, which of the following is true?

• A. Stacks have many layers, layers have many instances.
• B. Instances have many stacks, stacks have many layers.
• C. Layers have many stacks, stacks have many instances.
• D. Layers have many instances, instances have many stack

Answer: A

Explanation:
The stack is the core AWS OpsWorks component. It is basically a container for AWS resources—Amazon EC2 instances, Amazon RDS database instances, and so on—that have a common purpose and should
be logically managed together. You define the stack's constituents by adding one or more layers. A layer represents a set of Amazon EC2 instances that serve a particular purpose, such as serving applications or hosting a database server. An instance represents a single computing resource, such as an Amazon EC2 instance.
Reference: http://docs.aws.amazon.com/opsworks/latest/userguide/weIcome.htmI

NEW QUESTION 6
To monitor API calls against our AWS account by different users and entities, we can use to create a history of calls in bulk for later review, and use for reacting to AWS API calls in real-time.

• A. AWS Config; AWS Inspector
• B. AWS CIoudTraiI; AWS Config
• C. AWS CIoudTraiI; CIoudWatch Events
• D. AWS Config; AWS Lambda

Answer: C

Explanation:
CIoudTraiI is a batch API call collection service, CIoudWatch Events enables real-time monitoring of calls through the Rules object interface.
Reference: https://aws.amazon.com/whitepapers/security-at-scaIe-governance-in-aws/

NEW QUESTION 7
What method should I use to author automation if I want to wait for a CIoudFormation stack to finish completing in a script?

• A. Event subscription using SQS.
• B. Event subscription using SNS.
• C. Poll using <code>ListStacks</code> / <code>Iist-stacks</code>.
• D. Poll using <code>GetStackStatus</code> / <code>get-stack-status</code>.

Answer: C

Explanation:
Event driven systems are good for IFTTT logic, but only polling will make a script wait to complete. ListStacks / list-stacks is a real method, GetStackStatus / get-stack-status is not.
Reference: http://docs.aws.amazon.com/cli/latest/reference/cloudformation/Iist-stacks.html

NEW QUESTION 8
Your appIication's Auto Scaling Group scales up too quickly, too much, and stays scaled when traffic decreases. What should you do to fix this?

• A. Set a longer cooldown period on the Group, so the system stops overshooting the target capacit
• B. The issue is that the scaling system doesn't allow enough time for new instances to begin servicing requests before measuring aggregate load again.
• C. Calculate the bottleneck or constraint on the compute layer, then select that as the new metric, and set the metric thresholds to the bounding values that begin to affect response latency.
• D. Raise the CIoudWatch Alarms threshold associated with your autoscaling group, so the scaling takes more of an increase in demand before beginning.
• E. Use larger instances instead of lots of smaller ones, so the Group stops scaling out so much and wasting resources as the OS level, since the OS uses a higher proportion of resources on smaller instances.

Answer: B

Explanation:
Systems will always over-scale unless you choose the metric that runs out first and becomes constrained first. You also need to set the thresholds of the metric based on whether or not latency is affected by the change, tojustify adding capacity instead of wasting money.
Reference: http://docs.aws.amazon.com/AutoSca|ing/latest/DeveIoperGuide/poIicy_creating.htmI

NEW QUESTION 9
You are experiencing performance issues writing to a DynamoDB table. Your system tracks high scores for video games on a marketplace. Your most popular game experiences all of the performance issues. What is the most likely problem?

• A. DynamoDB's vector clock is out of sync, because of the rapid growth in request for the most popular game.
• B. You selected the Game ID or equivalent identifier as the primary partition key for the table.
• C. Users of the most popular video game each perform more read and write requests than average.
• D. You did not provision enough read or write throughput to the tabl

Answer: B

Explanation:
The primary key selection dramatically affects performance consistency when reading or writing to DynamoDB. By selecting a key that is tied to the identity of the game, you forced DynamoDB to create a hotspot in the table partitions, and over-request against the primary key partition for the popular game. When it stores data, DynamoDB dMdes a tabIe's items into multiple partitions, and distributes the data primarily based upon the partition key value. The provisioned throughput associated with a table is also dMded evenly among the partitions, with no sharing of provisioned throughput across partitions. Reference: http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GuideIinesForTabIes.htmI#GuideIi nesForTabIes.UniformWorkIoad

NEW QUESTION 10
For AWS Auto Scaling, what is the first transition state a new instance enters after leaving steady state when scaling out due to increased load?

• A. EnteringStandby
• B. Pending
• C. Terminating:Wait
• D. Detaching

Answer: B

Explanation:
When a scale out event occurs, the Auto Scaling group launches the required number of EC2 instances, using its assigned launch configuration. These instances start in the Pending state. If you add a lifecycle hook to your Auto Scaling group, you can perform a custom action here. For more information, see Lifecycle Hooks.
Reference: http://docs.aws.amazon.com/AutoScaling/latest/DeveIoperGuide/AutoScaIingGroupLifecycIe.html

NEW QUESTION 11
What is the scope of an EC2 security group?

• A. Availability Zone
• B. Placement Group
• C. Region
• D. VPC

Answer: C

Explanation:
A security group is tied to a region and can be assigned only to instances in the same region. You can't enable an instance to communicate with an instance outside its region using security group rules. Traffic
from an instance in another region is seen as WAN bandwidth.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/resources.htmI

NEW QUESTION 12
Which of the following are not valid sources for OpsWorks custom cookbook repositories?

• A. HTTP(S)
• B. Git
• C. AWS EBS
• D. Subversion

Answer: C

Explanation:
Linux stacks can install custom cookbooks from any of the following repository types: HTTP or Amazon S3 archives. They can be either public or private, but Amazon S3 is typically the preferred option for a private archive. Git and Subversion repositories provide source control and the ability to have multiple versions.
Reference:
http://docs.aws.amazon.com/opsworks/latest/userguide/workingcookbook-instaIlingcustom-enable.html

NEW QUESTION 13
You are designing a service that aggregates clickstream data in batch and delivers reports to subscribers via email only once per week. Data is extremely spikey, geographically distributed, high-scale, and unpredictable. How should you design this system?

• A. Use a large RedShift cluster to perform the analysis, and a fileet of Lambdas to perform record inserts into the RedShift table
• B. Lambda will scale rapidly enough for the traffic spikes.
• C. Use a CIoudFront distribution with access log delivery to S3. Clicks should be recorded as querystring GETs to the distributio
• D. Reports are built and sent by periodically running EMR jobs over the access logs in S3.
• E. Use API Gateway invoking Lambdas which PutRecords into Kinesis, and EMR running Spark performing GetRecords on Kinesis to scale with spike
• F. Spark on EMR outputs the analysis to S3, which are sent out via email.
• G. Use AWS Elasticsearch service and EC2 Auto Scaling group
• H. The Autoscaling groups scale based on click throughput and stream into the Elasticsearch domain, which is also scalabl
• I. Use Kibana to generate reports periodically.

Answer: B

Explanation:
Because you only need to batch analyze, anything using streaming is a waste of money. CIoudFront is a Gigabit-Scale HTTP(S) global request distribution service, so it can handle scale, geo-spread, spikes, and unpredictability. The Access Logs will contain the GET data and work just fine for batch analysis and email using EMR.
Can I use Amazon CIoudFront if I expect usage peaks higher than 10 Gbps or 15,000 RPS? Yes. Complete our request for higher limits here, and we will add more capacity to your account within two business days.
Reference: https://aws.amazon.com/Cloudfront/faqs/

NEW QUESTION 14
You are building a mobile app for consumers to post cat pictures online. You will be storing the images in AWS S3. You want to run the system very cheaply and simply. Which one of these options allows you to build a photo sharing application without needing to worry about scaling expensive uploads processes,
authentication/authorization and so forth?

• A. Build the application out using AWS Cognito and web identity federation to allow users to log in using Facebook or Google Account
• B. Once they are logged in, the secret token passed to that user is used to directly access resources on AWS, like AWS S3.
• C. Use JWT or SANIL compliant systems to build authorization policie
• D. Users log in with a username and password, and are given a token they can use indefinitely to make calls against the photo infrastructure.
• E. Use AWS API Gateway with a constantly rotating API Key to allow access from the client-sid
• F. Construct a custom build of the SDK and include S3 access in it.
• G. Create an AWS oAuth Service Domain ad grant public signup and access to the domai
• H. During setup, add at least one major social media site as a trusted Identity Provider for users.

Answer: A

Explanation:
The short answer is that Amazon Cognito is a superset of the functionality provided by web identity federation. It supports the same providers, and you configure your app and authenticate with those providers in the same way. But Amazon Cognito includes a variety of additional features. For example, it enables your users to start using the app as a guest user and later sign in using one of the supported identity providers.
Reference:
https://bIogs.aws.amazon.com/security/post/Tx3SYCORF5EKRCO/How-Does-Amazon-Cognito-Relate-to
-Existing-Web-Identity-Federatio

NEW QUESTION 15
Your system automatically provisions EIPs to EC2 instances in a VPC on boot. The system provisions the whole VPC and stack at once. You have two of them per VPC. On your new AWS account, your attempt to create a Development environment failed, after successfully creating Staging and Production environments in the same region. What happened?

• A. You didn't choose the Development version of the AMI you are using.
• B. You didn't set the Development flag to true when deploying EC2 instances.
• C. You hit the soft limit of 5 EIPs per region and requested a 6th.
• D. You hit the soft limit of 2 VPCs per region and requested a 3r

Answer: C

Explanation:
There is a soft limit of 5 E|Ps per Region for VPC on new accounts. The third environment could not allocate the 6th EIP.
Reference: http://docs.aws.amazon.com/generaI/latest/gr/aws_service_|imits.htmI#Iimits_vpc

NEW QUESTION 16
Your company needs to automate 3 layers of a large cloud deployment. You want to be able to track this depIoyment's evolution as it changes over time, and carefully control any alterations. What is a good way to automate a stack to meet these requirements?

• A. Use OpsWorks Stacks with three layers to model the layering in your stack.
• B. Use CloudFormation Nested Stack Templates, with three child stacks to represent the three logicallayers of your cloud.
• C. Use AWS Config to declare a configuration set that AWS should roll out to your cloud.
• D. Use Elastic Beanstalk Linked Applications, passing the important DNS entires between layers using the metadata interface.

Answer: B

Explanation:
Only CIoudFormation allows source controlled, declarative templates as the basis for stack automation. Nested Stacks help achieve clean separation of layers while simultaneously providing a method to control all layers at once when needed.
Reference:
https://bIogs.aws.amazon.com/application-management/post/TxlT9JYOOS8AB9I/Use-Nested-Stacks-to- Create-Reusable-Templates-and-Support-Role-SpeciaIization

NEW QUESTION 17
You are designing a system which needs, at minimum, 8 m4.Iarge instances operating to service traffic. When designing a system for high availability in the us-east-1 region, which has 6 Availability Zones, you company needs to be able to handle death of a full availability zone. How should you distribute the
servers, to save as much cost as possible, assuming all of the EC2 nodes are properly linked to an ELB? Your VPC account can utilize us-east-1's AZ's a through f, inclusive.

• A. 3 servers in each of AZ's a through d, inclusive.
• B. 8 servers in each of AZ's a and b.
• C. 2 servers in each of AZ's a through e, inclusive.
• D. 4 servers in each of AZ's a through c, inclusiv

Answer: C

Explanation:
You need to design for N+1 redundancy on Availability Zones. ZONE_COUNT = (REQUIRED_INSTANCES / INSTANCE_COUNT_PER_ZONE) + 1. To minimize cost, spread the instances across as many possible zones as you can. By using a though e, you are allocating 5 zones. Using 2 instances, you have 10 total instances. If a single zone fails, you have 4 zones left, with 2 instances each, for a total of 8 instances. By spreading out as much as possible, you have increased cost by only 25% and significantly de-risked an availability zone failure.
Reference:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.htmI#concepts- regions-availability-zones

NEW QUESTION 18
Which status represents a failure state in AWS CIoudFormation?

• A. <code>UPDATE_COMPLETE_CLEANUP_IN_PROGRESS</code>
• B. <code>DELETE_COMPLETE_WITH_ARTIFACTS</code>
• C. <code>ROLLBACK_IN_PROGRESS</code>
• D. <code>ROLLBACK_FAILED</code>

Answer: C

Explanation:
ROLLBACK_IN_PROGRESS means an UpdateStack operation failed and the stack is in the process of trying to return to the valid, pre-update state. UPDATE_COMPLETE_CLEANUP_IN_PROGRESS means an update was successful, and CIoudFormation is deleting any replaced, no longer used resources. ROLLBACK_FA|LED is not a CloudFormation state (but UPDATE_ROLLBACK_FAILED is). DELETE_COMPLETE_W|TH_ART|FACTS does not exist at all.
Reference:
http://docs.aws.amazon.com/AWSCIoudFormation/latest/UserGuide/using-cfn-updating-stacks.html

NEW QUESTION 19
Your application consists of 10% writes and 90% reads. You currently service all requests through a Route53 Alias Record directed towards an AWS ELB, which sits in front of an EC2 Auto Scaling Group. Your system is getting very expensive when there are large traffic spikes during certain news events, during which many more people request to read similar data all at the same time. What is the simplest and cheapest way to reduce costs and scale with spikes like this?

• A. Create an S3 bucket and asynchronously replicate common requests responses into S3 object
• B. When a request comes in for a precomputed response, redirect to AWS S3.
• C. Create another ELB and Auto Scaling Group layer mounted on top of the other system, adding a tier to the syste
• D. Serve most read requests out of the top layer.
• E. Create a CloudFront Distribution and direct Route53 to the Distributio
• F. Use the ELB as an Origin and specify Cache Behaviours to proxy cache requests which can be served late.
• G. Create a Memcached cluster in AWS EIastiCach
• H. Create cache logic to serve requests which can be served late from the in-memory cache for increased performance.

Answer: C

Explanation:
CIoudFront is ideal for scenarios in which entire requests can be served out of a cache and usage patterns involve heavy reads and spikiness in demand.
A cache behavior is the set of rules you configure for a given URL pattern based on file extensions, file names, or any portion of a URL path on your website (e.g., *.jpg). You can configure multiple cache behaviors for your web distribution. Amazon CIoudFront will match incoming viewer requests with your list of URL patterns, and if there is a match, the service will honor the cache behavior you configure for that URL pattern. Each cache behavior can include the following Amazon CIoudFront configuration values: origin server name, viewer connection protocol, minimum expiration period, query string parameters, cookies, and trusted signers for private content.
Reference: https://aws.amazon.com/Cloudfront/dynamic-content/

NEW QUESTION 20
You need to replicate API calls across two systems in real time. What tool should you use as a buffer and transport mechanism for API call events?

• A. AWS SQS
• B. AWS Lambda
• C. AWS Kinesis
• D. AWS SNS

Answer: C

Explanation:
AWS Kinesis is an event stream service. Streams can act as buffers and transport across systems for in-order programmatic events, making it ideal for replicating API calls across systems.
A typical Amazon Kinesis Streams application reads data from an Amazon Kinesis stream as data records. These applications can use the Amazon Kinesis Client Library, and they can run on Amazon EC2 instances. The processed records can be sent to dashboards, used to generate alerts, dynamically
change pricing and advertising strategies, or send data to a variety of other AWS services. For information about Streams features and pricing, see Amazon Kinesis Streams.
Reference: http://docs.aws.amazon.com/kinesis/Iatest/dev/introduction.htmI

NEW QUESTION 21
What is required to achieve gigabit network throughput on EC2? You already selected cluster-compute, 10GB instances with enhanced networking, and your workload is already network-bound, but you are not seeing 10 gigabit speeds.

• A. Enable biplex networking on your servers, so packets are non-blocking in both directions and there's no switching overhead.
• B. Ensure the instances are in different VPCs so you don't saturate the Internet Gateway on any one VPC.
• C. Select PIOPS for your drives and mount several, so you can provision sufficient disk throughput.
• D. Use a placement group for your instances so the instances are physically near each other in the same Availability Zone.

Answer: D

Explanation:
You are not guaranteed 10gigabit performance, except within a placement group.
A placement group is a logical grouping of instances within a single Availability Zone. Using placement groups enables applications to participate in a low-latency, 10 Gbps network. Placement groups are recommended for applications that benefit from low network latency, high network throughput, or both. Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

NEW QUESTION 22
There are a number of ways to purchase compute capacity on AWS. Which orders the price per compute or memory unit from LOW to HIGH (cheapest to most expensive), on average?
(A) On-Demand (B) Spot (C) Reserved

• A. A, B, C
• B. C, B, A
• C. B, C, A
• D. A, C, B

Answer: C

Explanation:
Spot instances are usually many, many times cheaper than on-demand prices. Reserved instances, depending on their term and utilization, can yield approximately 33% to 66% cost savings. On-Demand prices are the baseline price and are the most expensive way to purchase EC2 compute time. Reference: https://d0.awsstatic.com/whitepapers/Cost_Optimization_with_AWS.pdf

NEW QUESTION 23
You need to scale an RDS deployment. You are operating at 10% writes and 90% reads, based on your logging. How best can you scale this in a simple way?

• A. Create a second master RDS instance and peer the RDS groups.
• B. Cache all the database responses on the read side with CIoudFront.
• C. Create read replicas for RDS since the load is mostly reads.
• D. Create a Multi-AZ RDS installs and route read traffic to standb

Answer: C

Explanation:
The high-availability feature is not a scaling solution for read-only scenarios; you cannot use a standby replica to serve read traffic. To service read-only traffic, you should use a Read Replica. For more information, see Working with PostgreSQL, MySQL, and NIariaDB Read Replicas.
Reference: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.NIuItiAZ.htmI

NEW QUESTION 24
Which of these is not a CIoudFormation Helper Script?

• A. cfn-signal
• B. cfn-hup
• C. cfn-request
• D. cfn-get-metadata

Answer: C

Explanation:
This is the complete list of CloudFormation Helper Scripts: cfn-init, cfn-signal, cfn-get-metadata, cfn-hup Reference:
http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-helper-scripts-reference.html

NEW QUESTION 25
Your API requires the ability to stay online during AWS regional failures. Your API does not store any state, it only aggregates data from other sources - you do not have a database. What is a simple but effective way to achieve this uptime goal?

• A. Use a CloudFront distribution to serve up your AP
• B. Even if the region your API is in goes down, the edge locations CIoudFront uses will be fine.
• C. Use an ELB and a cross-zone ELB deployment to create redundancy across datacenter
• D. Even if a region fails, the other AZ will stay online.
• E. Create a Route53 Weighted Round Robin record, and if one region goes down, have that region redirect to the other region.
• F. Create a Route53 Latency Based Routing Record with Failover and point it to two identical deployments of your stateless API in two different region
• G. Make sure both regions use Auto Scaling Groups behind ELBs.

Answer: D

Explanation:
standard volumes, or Magnetic volumes, are best for: Cold workloads where data is infrequently accessed, or scenarios where the lowest storage cost is important.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVoIumeTypes.htmI

NEW QUESTION 26
......