Skill Assessment - AWS Q90

Q90. Which of these AWS services can be related to Lambda via a trigger? 

l  Cognito Sync Trigger, SNS

l  SNS, SQS

l  all of these answers

l  SQS, DynamoDB

 

 

Q91. When creating a RESTful API into a DynamoDB table, which is the right service to facilitate this?

l  API Sync

l  AppSync

l  CloudAPI

l  API Gateway

 

ChatGPT also says ..

The right service to facilitate the creation of a RESTful API into a DynamoDB table in the AWS ecosystem is "API Gateway."

 

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs. You can use API Gateway to create RESTful APIs that can integrate with various AWS services, including DynamoDB, and also external services. It provides features for request and response transformation, authentication, authorization, and rate limiting, making it a powerful tool for building RESTful APIs that interact with DynamoDB or other AWS resources.

 

The other options you mentioned, such as "API Sync," "AppSync," and "CloudAPI," are not standard AWS services for creating RESTful APIs into DynamoDB, and they may not be recognized services as of my last knowledge update in September 2021. However, AWS services and offerings can change over time, so it's a good practice to check the latest AWS documentation and services to ensure you are using the most up-to-date and appropriate tools for your specific use case.

 

 

Q92. Which AWS service is valid data source for AppSync?

l  DynamoDB table

l  ElastiCache

l  none of these answers

l  Step Functions

 

ChatGPT also adds ..

AWS AppSync allows you to connect to different data sources to provide the necessary backend data for your GraphQL APIs. DynamoDB is one of the supported data sources that can be integrated with AppSync to perform CRUD (Create, Read, Update, Delete) operations, making it an efficient way to retrieve and manipulate data through your GraphQL API.

 

ElastiCache and Step Functions are not natively supported data sources for AWS AppSync. ElastiCache is an in-memory data store and cache, while Step Functions is a serverless function orchestrator to coordinate multiple AWS services into serverless workflows, neither of which are directly integrated as data sources for AWS AppSync.

 

 

Q93. If a single instance has failed to launch within 24 hours due to some issues during a set up of Auto-scaling.

Then what will happen to the Auto-Scaling condition?

l  Auto Scaling will continue to launch the instance for straight 3 days

l  The Auto Scaling group will be automatically terminated.

l  In a separate region Auto Scaling will start an instance

l  Auto Scaling will remove the scaling process

 

ChatGPT states completely opposite opinion ..

If a single instance has failed to launch within 24 hours due to issues during the setup of Auto Scaling, the Auto Scaling group will not be automatically terminated. Instead, Auto Scaling will continue to attempt to launch instances based on the defined scaling policies.

 

Auto Scaling is designed to be resilient, and it will continue to monitor the health of the instances and make additional attempts to launch new instances to meet the defined scaling conditions. The failure to launch a single instance does not typically trigger the termination of the Auto Scaling group itself.

 

The exact behavior can vary depending on your Auto Scaling configuration, but typically, if an instance fails to launch due to issues, Auto Scaling will continue to retry the launch process based on your defined scaling policies until it reaches the maximum number of retries or until the issues causing the failures are resolved.

 

So, option "Auto Scaling will remove the scaling process" is not accurate, and the Auto Scaling group will not be terminated due to a single instance failing to launch.

 

注、ChatGPTの説明が自然で納得感が高い。ネットの追加解説記事を期待したい。

 

 

Q94. Point out the wrong statement.

l  Amazon Machine Instances are sized at various levels and rented on a computing/hour basis

l  The metrics obtained by CloudWatch may be used to enable a feature called Auto Scaling

l  A number of tools are used to support EC2 services

l  None of the mentioned

 

 

Q95. In terms of Amazon VPC design, a VPC with a single public subnet is ideal for which of the following application designs?

l  A single-tier application

l  A serverless application

l  A microservice application

l  A multi-tier application

 

ChatGPT also adds ..

A VPC (Virtual Private Cloud) with a single public subnet is more suitable for a single-tier application.

 

In VPC design, the "tier" refers to the layers of an application. A single-tier application typically involves a straightforward architecture where the entire application runs in a single layer without separation or division. This type of application is often simple, with both the application and database residing together.

 

A single public subnet in a VPC allows resources within that subnet to have direct access to the internet. This setup is ideal for a single-tier application where the application doesn’t require multiple layers of separation, such as front-end, back-end, and database layers, and instead can function adequately with a single public-facing layer.

 

For more complex applications such as multi-tier applications, serverless applications, or microservices, a VPC design typically involves multiple subnets, both public and private, with different layers of the application separated into different subnets for security, scalability, and manageability reasons. These designs often use a combination of public and private subnets, allowing for more controlled access and segregation of services.

 

Therefore, a VPC with a single public subnet is more suited for a single-tier application where the application and its associated components are not divided into separate layers.

 

 

Q96. If you stop and restart an EC2 instance, does it retain its private IP address?

l  Yes, the instance retains its private IP addresses

l  No, it retains only the public IP addresses

l  No, it retains only the Elastic IP addresses

l  No, it does not retain its private IP addresses

 

ChatGPT also adds ..

When you stop and restart an EC2 instance in Amazon Web Services, it retains its private IP address.

 

The private IP address of an EC2 instance is associated with the instance itself, not the state it's in. When you stop an EC2 instance and start it again, the private IP address remains the same unless you specifically terminate the instance.

 

However, it's important to note that the public IP address is subject to change upon each stop and start, unless you have an Elastic IP address attached. Elastic IP addresses are static and can be reassociated with an instance after a stop/start, maintaining a consistent public IP address.

 

But in the case of the private IP address, stopping and starting the instance does not affect it - the instance will retain the same private IP address it had before the stop.

 

 

Q97. All the Amazon EC2 instances you launch into a nondefault VPC are _ by default.

l  stateless

l  protected

l  public

l  private

 

 

Q98. When you launch an instance into a dedicated-tenancy VPC, what happens?

l  Your instance is automatically a Dedicated instance, regardless of the instance's specific tenancy attribute

l  You receive an error message notifying you that you must set your instance's tenancy attribute to dedicated

l  Your instance launch fails, but AWS prompts you to launch a new one with the tenancy attribute set to dedicated

l  Your instance launch fails immediately

 

 

Q99. Use the _ protocol in a VPC security group to communicate with a DB instance.

l  SSH

l  SSL

l  TCP

l  UDP

 

 

過去問

https://github.com/Ebazhanov/linkedin-skill-assessments-quizzes/blob/main/aws/aws-quiz.md

 

Skill Assessment - AWS Q80

Q80. How do you connect via SSH to a Linux EC2 instance with an EBS volume if you lost your key pair?

l  Stop the instance and create an AMI image. Launch the image using a new key pair.

l  Contact AWS support. A support specialist can remotely restore access to your instance and send you a new key pair.

l  You can not connect to this EC2 instance. The key pair is displayed only one time. If you lose it, you have lost all access to this instance. Connect the EBS volume to another instance to recover your files.

l  Attach the EBS volume to a temporary instance launched with a new key pair, and overwrite ~/.ssh/authorized_keys using the same file from the new instance.

 

ChatGPT also adds ..

If you've lost the key pair to your Linux EC2 instance, you can follow these steps to regain access:

 

1.      Stop the instance and create an AMI image: This is a good approach to preserve your instance's data. Here are the steps:

a. Stop the EC2 instance from the AWS Management Console or using the aws ec2 stop-instances command if you're using the AWS CLI.
b. Once the instance is stopped, create an Amazon Machine Image (AMI) from the instance. This will essentially take a snapshot of your instance.
c. Launch a new instance from the AMI, and during the launch process, choose a new key pair.
d. Start the new instance, and you'll have access to it with the new key pair.

2.      Contact AWS support: This is an option, but it may not be the fastest solution. AWS support can help you regain access to your instance, but you might experience some delays.

3.      You can not connect to this EC2 instance: This statement is not entirely accurate. While it's true that you can't recover the lost key pair, you can still regain access to your instance using other methods, such as the one mentioned in option 4:

4.      Attach the EBS volume to a temporary instance: You can attach the EBS volume from your inaccessible EC2 instance to a new temporary instance launched with a new key pair. Here are the steps:

a. Launch a new temporary EC2 instance with a new key pair.

b. Attach the EBS volume from the inaccessible instance to the temporary instance.

c. Mount the EBS volume to the temporary instance.

d. Edit the ~/.ssh/authorized_keys file on the EBS volume to add the new public key from your temporary instance. You can use a text editor or command-line tools like sed or echo.

e. Safely unmount the EBS volume and detach it from the temporary instance.

f. Attach the EBS volume back to your original instance.

g. Start your original instance.

 

You should now be able to SSH into your original instance using the new key pair that you added to the ~/.ssh/authorized_keys file. This method allows you to regain access to your instance without losing your data.

 

 

Q81. Your on-premise data center (172.16.128.0/24) is already connected to your AWS VPC (10.0.0.0/16) by a customer gateway.

You wish to connect another data center for a company you just acquired (172.16.130.0/24) to your VPC as shown in the image. What is the best way to create this link?

 

See the image at https://github.com/Ebazhanov/linkedin-skill-assessments-quizzes/blob/main/aws/images/Q80.png

 

l  Establish a connection between your two data centers and connect the second data center to the first through a private tunnel. Traffic will flow from the second data center and then through the first data, and then into AWS.

l  Create a second customer gateway and configure your VPN client at your second data center to connect to the virtual private gateway.

l  Create a second virtual private gateway (VPG) and attach it to the VPC. Create a customer gateway for the new virtual private gateway and use your VPN client at your second data center to establish a connection to the VPG.

l  You can not have more than one customer gateway per VPC, so the proposed solution will not work. Create a second VPC with a virtual private gateway and a customer gateway. Bridge the two VPCs using VPC peering.

 

 

Q82. You are migrating a 200 GB database from an on-premise SQL Server to RDS for SQL Server.

The database needs to have minimal downtime during the migration. What is the best practice for migrating this database?

 

l  Close all existing connections to the SQL Server database and use Database Migration Service to transfer the data to RDS.

l  Use Database Migration Service to replicate the database to RDS and keep it in sync during the migration. Repoint your applications to use the new RDS endpoint.

l  Detach the SQL Server database during the migration. Take a backup of the database and use SQ with Accelerated Transfer to upload the backups to S3. Restore the backups to the RDS instance.

l  Use the Import and Export wizard within SQL Server Enterprise Manager to create an export task and export the tables to the RDS instance.

 

 

Q83. You have enabled Multi-Factor Authentication (MFA) for your AWS root account and you lost your MFA device.

What do you need to do to recover access to your account?

 

l  You cannot recover access to your AWS root account. Contact AWS support.

l  An email will be sent to the email address on file to verify ownership of the account. You will then need to provide the phone number on the account.

l  An email will be sent to the email address on file. After clicking in the link in your email, provide one of the MFA recovery codes that were created when MFA was enabled.

l  Use the AWS CLI with the root account access token to disable MFA on the root account. Then use the CLI to set a new password on the root account.

 

ChatGPT has a different opinion ..

If you've enabled Multi-Factor Authentication (MFA) for your AWS root account and you've lost your MFA device, you can recover access to your account by using MFA recovery codes, not the AWS CLI. Here's the correct process:

 

An email will be sent to the email address on file. After clicking the link in your email, provide one of the MFA recovery codes that were created when MFA was enabled.

 

When you initially set up MFA on your AWS root account, you should have received recovery codes. These recovery codes are meant to be used in situations where you've lost access to your MFA device. You can use one of these recovery codes to regain access to your AWS account.

 

Using the AWS CLI to disable MFA on the root account is not the recommended approach in this situation. Instead, follow the procedure provided by AWS, which typically involves using recovery codes or contacting AWS support for assistance.

 

Amazon also says at the reference page ..

If your AWS account root user multi-factor authentication (MFA) device is lost, damaged, or not working, you can sign in using another MFA device registered to the same AWS account root user. If the root user only has one MFA device enabled, you can use alternative methods of authentication. This means that if you can't sign in with your MFA device, you can sign in by verifying your identity using the email and the primary contact phone number registered with your account.

 

注、アマゾンのユーザガイドの説明が納得感ある。

①まず重要なアカウント（root user）には複数の（予備の）MFAデバイスを登録しておく。

➁MFAデバイスのどれでもサインインできない場合には、模範解答通りアカウント登録時に添えたメールと電話番号で身分証明してサインインできる。

 

Ref. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html

 

 

Q84. How do you assign an Elastic IP to several EC2 instances?

 

l  In the VPC dashboard, click Elastic IPs. Select the Elastic IP and click Associate Address. Select each EC2 instance you wish to assign this address to.

l  In the EC2 dashboard, click on EC2 instance. Under Actions, select networking > Manage IP Addresses. click to add a new IP address and type in the address of the Elastic IP. Repeat the process for each EC2 instance you want to assign this Elastic IP to.

l  Use the AWS CLI and pass in several '--instance-id' options to hte aws ec2 assosiate-address command.

l  An elastic IP cannot be assigned to multiple EC2 instances. It can only be assosiated to a single EC2 instance.

 

 

Q85. You created a VPC that has a public subnet and a private subnet.

A web server was placed in the public subnet and a database server was placed in the private subnet. The web server is able to connect to the database server; however, the database server at 10.0.1.2 is unable to get software updates. What is the cause of this issue?

 

l  There is no NAT gateway for the private subnet, so the database server has no routes that give it public internet access to download software updates.

l  The database server needs to be assigned a public address from the pool, or assigned an Elastic IP similar to the instance 10.0.0.2.

l  The router is not configured properly on the VPC. Add a route to route table for the VPC that routes all traffic for 0.0.0.0/0 to the ID of the internet gateway.

l  There is no egress-only internet gateway attached to the private subnet of the VPC.

 

 

Q86. Benefit of using S3 Glacier?

 

l  access time

l  store for small duration

l  cost

l  cross-region

 

 

Q87. After installing AWS Amplify's CLI, what command allows the user to connect an AWS account with the local install?

 

l  amplify admin

l  amplify configure

l  amplify connect

l  amplify init

 

ChatGPT also says ..

This command initiates the configuration process, enabling the user to connect the AWS Amplify CLI with their AWS account by providing necessary access credentials and setting up the local environment.

 

 

Q88. How do you limit access to an S3 bucket by source IP address?

 

l  Create the S3 bucket as a target for Application Load Balancer. Use Web Application Firewall (WAF) to create a rule to limit access to the S3 bucket by source IP.

l  You can not limit access to an S3 bucket by IP address.

l  In the properties of the S3 bucket, add an access control option that limit access to the bucket by source IP address. Input the list of IPs into dialog.

l  Create a bucket policy with a condition that limit access to a list of approved IP addresses. Attach this policy to the bucket.

 

ChatGPT also says ..

The correct way to limit access to an S3 bucket by source IP address is by creating a bucket policy with a condition that restricts access to a specific list of approved IP addresses. This is achieved by defining a condition within the bucket policy that allows access only from certain IP addresses.

 

The correct answer is: Create a bucket policy with a condition that limits access to a list of approved IP addresses. Attach this policy to the bucket.

 

By creating a bucket policy, you can specify a condition using the "IpAddress" condition key, allowing or denying access based on the incoming request's source IP address. Here's an example of a bucket policy that restricts access to a specific IP range:

 

json

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Deny",

            "Principal": "*",

            "Action": "s3:*",

            "Resource": "arn:aws:s3:::bucket-name/*",

            "Condition": {

                "NotIpAddress": {

                    "aws:SourceIp": [

                        "192.0.2.0/24",    // Example IP range 1

                        "10.0.0.1/32"      // Example IP 2

                    ]

                }

            }

        }

    ]

}

This policy denies access to the S3 bucket for any requests that do not originate from the specified IP addresses (in this case, "192.0.2.0/24" and "10.0.0.1/32").

 

Remember to replace "bucket-name" with the name of your S3 bucket and modify the IP addresses or IP ranges according to your requirements.

 

 

Q89. What is the benefits of using S3 Glacier for storage?

 

l  granual fetching

l  cross-region caching

l  speed of access

l  cost