Amazon Amazon Certifications SAP-C01 Questions & Answers

• Question 661:

  Which of the following is NOT a true statement about Auto Scaling?

  A. Auto Scaling can launch instances in different Azs.

  B. Auto Scaling can work with CloudWatch.

  C. Auto Scaling can launch an instance at a specific time.

  D. Auto Scaling can launch instances in different regions.

  Correct Answer: D

  Auto Scaling provides an option to scale up and scale down based on certain conditions or triggers from Cloudwatch. A user can configure such that Auto Scaling launches instances across Azs, but it cannot span across regions.

  Reference: http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-dg.pdf

• Question 662:

  An Auto Scaling group is running at the desired capacity of 5 instances and receives a trigger from the Cloudwatch Alarm to increase the capacity by 1. The cool down period is 5 minutes. Cloudwatch sends another trigger after 2 minutes to decrease the desired capacity by 1.

  What will be the count of instances at the end of 4 minutes?

  A. 4

  B. 5

  C. 6

  D. 7

  Correct Answer: C

  The cool down period is the time difference between the end of one scaling activity (can be start or terminate) and the start of another one (can be start or terminate). During the cool down period, Auto Scaling does not allow the desired capacity of the Auto Scaling group to be changed by any other CloudWatch alarm. Thus, in this case the trigger from the second alarm will have no effect.

  Reference: http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/AS_Concepts.html#healthcheck

• Question 663:

  Can you configure multiple Load Balancers with a single Auto Scaling group?

  A. No

  B. Yes, you can but only if it is configured with Amazon Redshift.

  C. Yes, you can provide the ELB is configured with Amazon AppStream.

  D. Yes

  Correct Answer: D

  Yes, you can configure more than one load balancer with an autoscaling group. Auto Scaling integrates with Elastic Load Balancing to enable you to attach one or more load balancers to an existing Auto Scaling group. After you attach the load balancer, it automatically registers the instances in the group and distributes incoming traffic across the instances.

  Reference: http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/AS_Concepts.html

• Question 664:

  An organization, which has the AWS account ID as 999988887777, has created 50 IAM users. All the users are added to the same group ABC. If the organization has enabled that each IAM user can login with the AWS console, which AWS login URL will the IAM users use??

  A. https://999988887777.aws.amazon.com/ABC/

  B. https://signin.aws.amazon.com/ABC/

  C. https://ABC.signin.aws.amazon.com/999988887777/console/

  D. https://999988887777.signin.aws.amazon.com/console/

  Correct Answer: D

  AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. Once the organization has created the IAM users, they will have a separate AWS console URL to login to the AWS console. The console login URL for the IAM user will be https:// AWS_Account_ID.signin.aws.amazon.com/console/. It uses only the AWS account ID and does not depend on the group or user ID.

  Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/AccountAlias.html

• Question 665:

  An organization has setup RDS with VPC. The organization wants RDS to be accessible from the internet. Which of the below mentioned configurations is not required in this scenario?

  A. The organization must enable the parameter in the console which makes the RDS instance publicly accessible.

  B. The organization must allow access from the internet in the RDS VPC security group,

  C. The organization must setup RDS with the subnet group which has an external IP.

  D. The organization must enable the VPC attributes DNS hostnames and DNS resolution.

  Correct Answer: C

  A Virtual Private Cloud (VPC) is a virtual network dedicated to the user's AWS account. It enables the user to launch AWS resources, such as RDS into a virtual network that the user has defined. Subnets are segments of a VPC's IP address range that the user can designate to a group of VPC resources based on security and operational needs. A DB subnet group is a collection of subnets (generally private) that the user can create in a VPC and which the user assigns to the RDS DB instances. A DB subnet group allows the user to specify a particular VPC when creating DB instances. If the RDS instance is required to be accessible from the internet: The organization must setup that the RDS instance is enabled with the VPC attributes, DNS hostnames and DNS resolution. The organization must enable the parameter in the console which makes the RDS instance publicly accessible. The organization must allow access from the internet in the RDS VPC security group.

  Reference: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.html

• Question 666:

  In Amazon ElastiCache, which of the following statements is correct?

  A. When you launch an ElastiCache cluster into an Amazon VPC private subnet, every cache node is assigned a public IP address within that subnet.

  B. You cannot use ElastiCache in a VPC that is configured for dedicated instance tenancy.

  C. If your AWS account supports only the EC2-VPC platform, ElastiCache will never launch your cluster in a VPC.

  D. ElastiCache is not fully integrated with Amazon Virtual Private Cloud (VPC).

  Correct Answer: B

  The VPC must allow non-dedicated EC2 instances. You cannot use ElastiCache in a VPC that is configured for dedicated instance tenancy.

  Reference: http://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/AmazonVPC.EC.html

• Question 667:

  Identify a true statement about the statement ID (Sid) in IAM.

  A. You cannot expose the Sid in the IAM API.

  B. You cannot use a Sid value as a sub-ID for a policy document's ID for services provided by SQS and SNS.

  C. You can expose the Sid in the IAM API.

  D. You cannot assign a Sid value to each statement in a statement array.

  Correct Answer: A

  The Sid (statement ID) is an optional identifier that you provide for the policy statement. You can assign a Sid a value to each statement in a statement array. In IAM, the Sid is not exposed in the IAM API. You can't retrieve a particular statement based on this ID.

  Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Sid

• Question 668:

  Is there any way to own a direct connection to Amazon Web Services?

  A. No, AWS only allows access from the public Internet.

  B. No, you can create an encrypted tunnel to VPC, but you cannot own the connection.

  C. Yes, you can via Amazon Dedicated Connection

  D. Yes, you can via AWS Direct Connect.

  Correct Answer: D

  AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard 1 gigabit or 10 gigabit Ethernet fiber-optic cable. One end of the cable is connected to your router, the other to an AWS Direct Connect router. With this connection in place, you can create virtual interfaces directly to the AWS cloud (for example, to Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Simple Storage Service (Amazon S3)) and to Amazon Virtual Private Cloud (Amazon VPC), bypassing Internet service providers in your network path.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

• Question 669:

  Which of the following statements is correct about the number of security groups and rules applicable for an EC2-Classic instance and an EC2-VPC network interface?

  A. In EC2-Classic, you can associate an instance with up to 5 security groups and add up to 50 rules to a security group. In EC2-VPC, you can associate a network interface with up to 500 security groups and add up to 100 rules to a security group.

  B. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 50 rules to a security group. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 100 rules to a security group.

  C. In EC2-Classic, you can associate an instance with up to 5 security groups and add up to 100 rules to a security group. In EC2-VPC, you can associate a network interface with up to 500 security groups and add up to 50 rules to a security group.

  D. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 100 rules to a security group. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 50 rules to a security group.

  Correct Answer: D

  A security group acts as a virtual firewall that controls the traffic for one or more instances. When you launch an instance, you associate one or more security groups with the instance. You add rules to each security group that allow traffic to or from its associated instances. If you're using EC2-Classic, you must use security groups created specifically for EC2-Classic. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 100 rules to a security group. If you're using EC2-VPC, you must use security groups created specifically for your VPC. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 50 rules to a security group.

  Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html

• Question 670:

  Which of the following statements is correct about AWS Direct Connect?

  A. Connections to AWS Direct Connect require double clad fiber for 1 gigabit Ethernet with Auto Negotiation enabled for the port.

  B. An AWS Direct Connect location provides access to Amazon Web Services in the region it is associated with.

  C. AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard 50 gigabit Ethernet cable.

  D. To use AWS Direct Connect, your network must be collocated with a new AWS Direct Connect location.

  Correct Answer: B

  AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard 1 gigabit or 10 gigabit Ethernet fiber-optic cable. An AWS Direct Connect location provides access to Amazon Web Services in the region it is associated with, as well as access to other US regions. To use AWS Direct Connect, your network is collocated with an existing AWS Direct Connect location. Connections to AWS Direct Connect require single mode fiber, 1000BASE-LX (1310nm) for 1 gigabit Ethernet, or 10GBASE-LR (1310nm) for 10 gigabit Ethernet. Auto Negotiation for the port must be disabled.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html