Cloud Architecting Quiz and Answer

AURI, NURI, PURI.

AWS Cost Explorer

False

(i) Inbound data transfer (with some exceptions), (ii) Data transfer between services within the same AWS Reg

Basic, Developer, Business, Enterprise

Total Cost of Ownership calculator

Economics of scale

True

Free inbound data transfer for Amazon Elastic Computer Cloud (Amazon EC2) instances Free outbound data transfer between AWS services within the same Region

False

Data lake

Bucket names are globally unique. If the requested bucket name is not available, the developer must rename the bucket.

Bucket

https://frank-martha-cafe.s3-website-us-east-1.amazonaws.com

False

5GB

Bucket policy

The bucket endpoint URL

Secure Sockets Layer/Transport Layer Security (SSL/TLS)

Cross-Origin Resources Sharing (CORS) has not been enabled on the bucket where the assets are stored

Amazon S3

An internet-accessible storage location for video files that an external website can access

(i) HTML files and image files, (ii) Video and sound files, and (iii) client-side scripts

(i) enabling server-side encryption on the S3 bucket before uploading sensitive data, and (ii) using client-side encrytion to protect data in transit before it is sent to Amazon S3

Store case data in S3 Standard. Use a lifecycle policy to move the data into S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Amazon S3 Transfer Acceleration

Amazon S3 multipart uploads.

S3 One Zone-Infrequent Access (S3 One Zone-IA)

S3 Glacier Deep Archive

(i) complete control of computing resources, and (ii) ability to run any type of workload

(I) selling or sharing software solutions packaged as an AMI, (ii) using an AMI as a server backup for Amazon EC2 instances, and (iii) launching instances with the same configuration

Stop an Amazon EBS-backed instance, change its instance type, and start the instance

Use the user data of each instance to access the MAC address through the instance metadata

(i) by default, user data runs only once, when an instance is launched, and (ii) the cloud architect must remove the config_user_scripts file to rerun the user data scripts

Provisioned IOPS SSD volume type

(i) Automatic scaling, and (ii) high availability

Fully managed Windows file servers

(i) with On-Demand Instances, customers can pay for compute capacity by usage time with no long term commitments, and (ii) Spot instances offer spare compute capacity at discounted prices, and can be interrupted.

AWS manages database patches for a database on a managed database service.

(i) the data is highly structured, and (ii) student, course, and registration data are stored in many different tables.

Amazon DynamoDB

(i) unpredictable object attributes for player-created objects, and (ii) a high amount of read activity on player-created objects and a low amount of writes

Amazon Neptune

Amazon Aurora

(i) a virtual private cloud (VPC) to provide instance isolation, (ii) security groups to control network access to individual RDS instances, and (ii) encryption both ar rest and in transit to protect sensitive data.

(i) AWS IAM policies to define access at the table, item, or attribute level, (ii) encryption to protect sensitive data, and (iii) An Amazon VPC gateway endpoint to prevent traffic from traversing the internet

use AWS Schema Conversion Tool to convert the schema, and then use AWS Database Migration Service to migrate the data.

Set up an RDS MySQL Multi-AX DB instance. Configure a read replica in a different Region.

a logically isolated virtual network that you define in the AWS Cloud.

EC2 instance inside a private subnet.

Subnet A: 172.16.0.0/23 (512 addresses) Subnet B: 172.16.0.0/23 (512 addresses)

Without public IP addresses, in a subnet with a default route to a NAT gateway

Associate an Elastic IP with the EC2 instance

(i) Add a rule to the EC2 instance security group to allow return traffic from the bastion host security group on port 22, and (ii) Add a rule to the bastion host security group to allow traffic on port 22 from your source IP address.

Add rules to the subnet custom network ACL to allow traffic from and to allowed internet addresses

(i) Divide the VPC network range evenly across all Availability Zones available, (ii) Create one subnet per Availability Zone for each group of hosts that have unique routing requirements, and (iii) Reserve some address space for future use

(i) Amazon CloudWatch, (ii) Amazon S3 bucket, and (iii) Amazon Kinesis Data Firehose

gateway VPC enpoint

Connect the VPCs to AWS Transit Gateway

Transit gateway peering attachment

VPC peering

(i) create a VPC gateway endpoint for Amazon S3, and (ii) use VPC interface endpoints

add a peering connection between A and C, and route traffic between A and C through the perring connection

AWS Site-to-Site VPN

AWS Global Accelerator

AWS Direct Connect

An on-demand AWS Site-toSite VPN connection across the internet

implement AWS Direct Connect as the primary connection and use the VPN to create connectivity to multiple VPCs across multiple AWS Regions.

(i) new users added to a group inherit the group’s permissions, (ii) a user can belong to more than one group.

ABAC will likely require fewer policies than RBAC

Access to S3, EC2, and CloudFront, but no access to ECS

it enables the use of an external identity provider to authenticate workforces users and give them access to AWS resources

Amazon Cognito

AWS Organizations

create a service control policy (SCP), and attach it to the production OU.

envelope encryption.

(i) rotate keys, and (ii) create symmetric and asymmetric keys.

Amazon Macie

it can launch Amazon EC2 instances in multiple Availability Zones

scheduled

target tracking scaling

By changing the instance class or size.

By adding Aurora Replica instances by using Aurora Auto Scaling.

It adjusts the provisioned throughput capacity in response to traffic patterns.

Network load balancer

An Auto Scaling group launches Amazon EC2 instances, which are served by an Application Load Balancer. DNS name resolution points to the load balancer.

Use geolocation routing with failover records in Amazon Route 53.

Create an Amazon CloudWatch alarm to send you an email message when the account billing exceeds $0.

(i) lack of version control with manual process, (ii) alignment with the reliability design principle

(i) deploy environments with configuration consistency, and (ii) propagates updates from single environment to all environments.

An AWS Quick Start

An artificial intelligence (AI)-powered coding companion.

(i) accelerate coding tasks, and (ii) enhance application security

An AWS service that you can use to create, model and manage AWS resources

A graphical design interface for creating AWS CloudFormation templates

use conditions

Create a change set

Run drift detection on the stack

An high-speed data storage layer used for storing frequently accessed data.

static data that is frequently accessed.

reduced response latency

(i) web objects such as hyperlinks, and (ii) video files such as a product demo

Multi-tiered and regional caching of content

It caches frequently accessed content at the edge locations. It delivers the cached content to clients through the edge location with the lowest latency to those clients.

Use Amazon S3 to store the content. Then use Amazon CloudFront to deliver the content.

Routes traffic through edge locations

(i) Read data from ElastiCache first and write to ElastiCache when a cache miss occurs, and (ii) Write data to ElastiCache whenever the application writes to the database.

Write-through

Components in a tightly coupled architecture are highly dependent on each other. In a loosely coupled architecture, components are not highly dependent on each other.

(i) Stores and optionally encrypts messages until they are processed and deleted, (ii) Enables you to decouple and scale microservices, distributed systems, and serverless applications, and (iii) requires a consumer to poll the queue for messages

The application places job messages in an SQS queue. EC2 instances with available processing capacity pull the next job message from the queue.

A fully managed messaging service for both system-to-system and application-to-application communication which uses publish/subscribe (pub/sub) patterns

(i) Notify multiple systems that user input is ready for processing, (ii) Send a push notification to mobile applications when a new software update is available, and (iii) Send a text message to systems operators when unusual activity has been detected.

(i) Message delivery to an Amazon Simple Queue Service (Amazon SQS) queue, and (ii) Message delivery to a URL

Send the S3 event to an Amazon Simple Notification Service (Amazon SNS) topic that both Lambda functions subscribe to.

Message broker service

Leveraging an existing on-premesis application that uses Apache ActiveMQ to communicate between microservices

(i) continuous scaling, (ii) built-in high availability, and (iii) pay-for-value services

Host static assets in an Amazon S3 bucket, use an Amazon DynamoDB table, and use Amazon API Gateway and AWS Lambda functions to interact with the database

(i) solves a specific business problem, and (ii) independence from other components

None because the AWS Lambda service scales functions automatically

Lambda layers

Standardized, portable application code packages that contain code and code dependencies. A container is run by a container engine. A container does not include a guest operating system.

Create services that each provide a distinct function of the application, and run each service in a separate container that Amazon ECS manages.

Create a public interface by using Amazon API Gateway with Lambda functions accessing the DynamoDB sensor database.

(i) Update inventory and run a shipment workflow when a customer purchases an item on an e-commerce site, (ii) implement manual approval in a security incident response workflow, and (iii) coordinate multi-step analytics and machine learning workflows.

A task or activity state with an activated wait for callback parameter

a shopping website collects clickstream to make personalized recommendations while a user is shopping. When the website is very busy, there is a delay in returning results to customers

Give users the ability to access all of organization’s data by integrating a data lake, a data warehouse, and other purpose-built data stores

Send sales transaction data from a retailer’s website to a central location periodically. Analyze the data overnight, and deliver reports to branches in the morning

Use AWS DataSync to transfer data from the on-premises file store to an Amazon S3 bucket in the data lake

Run an AWS Glue crawler on the S3 bucket

Use Amazon Kinesis Data Stream to capture the data. Use Amazon Kinesis Data Anlytcis to consume and transform data from the stream. Use Amazon Kinesis Data Firehose to deliver transformed sata to OpenSearch Service

Archive data out of relational databases into a more cost-efficient storage option

Amazon S3

Amazon EMR

Amazon Athena

RPO is the maximum acceptable data loss, measured in time. RTO is the maximum acceptable time until recovery.

use AWS CloudFormation templates to deploy duplicate environments in the same Region

Enable cross-Region replication on the bucket and copy exiting objects onto themselves.

store essential data separately from the instance, and develop rapid rebuild processes for compute instances.

Amazon Route 53

most cost-effective, but highest recovery time objective (RTO)

(i) warm standy has scaled-down version of all infrastructure that scales as necessary and within pre-defined limits to meet th load when a distater occurs, and (ii) pilot light has minimal infrastructure that always runs. The rest of the infrastructure does not run until a disaster occurs.

it involves automatic failover to a second fully functional, constantly operational system that is in another site

warm standby

(i) present cloud-based internet Small Computer Systems Interface (iSCSI) block storage volume to on-premises applications, (ii) use Server Message Block (SMB) or Network File System (NFS) to connect to Amazon S3, and (iii) transfer backup from tape or Virtual Tape Library (VTL) systems to the cloud

Amazon EC2 instances with Microsoft SQL Server and data replication between two different AZs

Configure CloudFront to require users to access the files using a signed URL, create an origin access identity (OAI) and restrict access to the files in the Amazon S3 bucket to the OAI

Cache static content using CloudFront

(i) Create an AMI of each EC2 instance and copy the AMIs to the other region, and (ii) Create new EC2 instances from the AMIs

Use a CloudFormation StackSet and specify the target accounts and regions in which the stacks will be created

(i) Create and configure an Amazon S3 VPC endpoint, and (ii) Enable Amazon RedShift Enhanced VPC routing

Amazon Redshift

(i) AWS CloudFormation, and (ii) AWS Elastic Beanstalk

Use a target tracking policy that keeps the average aggregate CPU utilization at 40%

(i) Elastic Load Balancer and Auto Scaling, and (ii) Multiple Availability Zones

AWS Budgets

Public subnets for the application tier and NAT Gateway, and private subnets for the database cluster

An EC2 instance is in different availability zones than load balancer.

(i) RedShift provides continuous/incremental backups, (ii) RedShift always keeps three copies of your data

Modify the security group used by the EC2 cluster to allow incoming traffic from the security group used by the ALB only

Create an ElastiCache database in the U.S east region.

Launch all EC2 instances in a placement group using a Cluster placement strategy.

(i) Hibernate, (ii) Stop

Amazon CloudFront with an Amazon S3 bucket origin

Use S3 Intelligent-Tiering storage class.

VPC Flow Logs

AWS Lambda

AWS Global Accelerator

Kinesis Data Streams and Kinesis Data Analytics

Maintain a single snapshot; the latest snapshot is both incremental and complete

(i) Use AWS Glue to extract, transform and load the data into the target data store, and (ii) Configure S3 event notifications to trigger a Lambda function when data is uploaded and use the Lambda function to trigger the ETL job

Network Optimization

Amazon DynamoDB

The number of messages in the SQS queue.

Update the security group by removing the rule

Amazon EBS General Purpose SSD

(i) DynamoDB, and (ii) ElastiCache

Increase visibility timeout to 60 seconds.

(i) A network ACL can be associated with multiple subnets, and (ii) Subnet’s IP CIDR block can be same as the VPC CIDR block.

DynamoDB with Global Tables and Cross Region Replication

(i) Modify the permissions on the Amazon S3 bucket so that only the origin access identity has read and download permissions, and (ii) Create an origin access identity and associate it with your distribution

Versioning

RDS DB instance using a Multi-AZ configuration

AWS DynamoDB

Store the files on Amazon S3, and create a lifecycle policy to remove the files after three months

Deploy an AWS CloudFormation template that defines components of the VPC

Generate a pre-signed URL and distribute it to the consumers

(i) CloudFront, and (ii) AWS Global Accelerator

Configure a scheduled action in the Auto Scaling group by specifying the recurrence, start/end time, capacities, etc.

Store data in an S3 bucket and enable versioning.

Create an IAM role with permissions to access the table, and launch all instances with the new role.

(i) In a Network ACL, for a successful HTTPS connection, you must add an inbound rule and outbound rule with HTTPS type, IP range in source and destination respectively and ALLOW traffic, and (ii) In a Security Group, for a successful HTTPS connection, add an inbound rule with HTTPS type and IP range in the source.

Configure Elastic Fabric Adapter (EFA) in the instance.

Deploy Bastion hosts in Public Subnet

Create an Auto Scaling scheduled action to scale out the necessary resources at 8:30am each morning

Launch an Application Load Balancer (ALB)

Define a cluster security group for the cluster that allows access from the allowed networks.

(i) Redirect read queries to RDS read replicas, and (ii) Scale up to a larger RDS instance type

Elastic Transcoder

Create a Windows File Server in Amazon FSx.

Use AWS PrivateLink

AWS Storage Gateway - File Gateway

Create a Lustre file system through Amazon FSx.

Amazon DynamoDB

Copy snapshot from the latest snapshot of your RDS instance, select encryption during copy and restore a new DB instance from the newly encrypted snapshot.

EBS Provisioned IOPS SSD

DynamoDB

CloudFormation

Use a Spread Placement Group across two AZs

Access the data through a VPC endpoint for Amazon S3.

Subnet Group

Implement a Storage Gateway Volume Gateway in cached mode

Transition objects from Amazon S3 Standard to Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

Key Pairs

Amazon Cognito

ElastiCache with the Redis engine

Visibility Timeout on the SQS queue is set to 10 minutes.

Amazon MQ

AWS KMS API

AWS Device Farm

Use an AWS Application Load Balancer with a path-based routing rule to route traffic to the correct service

Change the EC2 instance type to one with EC2 instance store volumes

AWS Global Accelerator

IAM roles for tasks

EC2 instance

DynamoDB

(i) Use CloudFront with a Web and RTMP distribution, and (ii) Store the media files in an S3 bucket

EBS Provisioned IOPS SSD

1

Launch an unencrypted EC2 instance and create a snapshot of the root volume. Make a copy of the snapshot with the encryption option selected and Create Image using the encrypted snapshot. Use this image to launch EC2 instances.

NAT Gateway

(i) Modify the CloudWatch alarm period that triggers your Auto Scaling scale down policy, and (ii) Modify the Auto Scaling group cool-down timers

(i) Create a DB Server security group that allows MySQL port 3306 inbound and specify the source as the Web Server security group and (ii) Create a Web Server security group that allows HTTPS port 443 inbound traffic from anywhere (0.0.0.0/0) and apply it to the Web Servers.

Amazon Aurora

Create an image from the instance. Launch an instance from the AMI in the destination AZ

Enable DynamoDB DAX

Use RDS in a Multi-AZ configuration

Amazon Aurora

AssumeRoleWithSAML

Amazon EFS

Routes not configured in route tables for peering connections.

Use CloudFront and set the S3 bucket as an origin

(i) Use Instance user data for shell scripts, and (ii) Use AutoScaling Group lifecycle hooks and trigger AWS Lambda function through CloudWatch events.

Configuring lifecycle configuration rules on the S3 bucket

Configure CloudFront to deliver the content in the S3 bucket.

AWS SQS FIFO

Use the “Range” HTTP header in a GET request to download the specified range bytes of an object.

Use VPC Peering between both accounts

The NAT Instance

Target tracking scaling policy

IAM user

Service control policy (SCP).

(i) HTML files, and (ii) Image files

Compute optimized instance type.

Amazon EC2 Stop Instances

Take a snapshot, and store it for 6 months.

(i) AWS Database Migration Service (AWS DMS), and (ii) AWS Schema Conversion Tool (AWS SCT).

AWS Site-to-Site VPN.

Transit gateway peering attachments

AWS IAM Identity Center

Predictive scaling policy

Amazon Aurora Serverless

Configure Amazon CloudFront and connect to the S3 bucket as a source

Decouple the architecture by adding Application Load Balancers between the tiers

Use Amazon Simle Notification Service (Amazon SNS)

Amazon Kinesis Data Streams because it has lower latency when compared to Amazon Kinesis Data Firehose, which has a minimum buffer of 60 seconds

Back-up and restore