Amazon Amazon Certifications SAP-C01 Questions & Answers

• Question 701:

  In AWS IAM, which of the following predefined policy condition keys checks how long ago (in seconds) the MFA-validated security credentials making the request were issued using multi- factor authentication (MFA)?

  A. aws:MultiFactorAuthAge

  B. aws:MultiFactorAuthLast

  C. aws:MFAAge

  D. aws:MultiFactorAuthPrevious

  Correct Answer: A

  aws:MultiFactorAuthAge is one of the predefined keys provided by AWS that can be included within a Condition element of an IAM policy. The key allows to check how long ago (in seconds) the MFA-validated security credentials making the request were issued using Multi-Factor Authentication (MFA).

  Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html

• Question 702:

  Which of following IAM policy elements lets you specify an exception to a list of actions?

  A. NotException

  B. ExceptionAction

  C. Exception

  D. NotAction

  Correct Answer: D

  The NotAction element lets you specify an exception to a list of actions.

  Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html

• Question 703:

  How does AWS Data Pipeline execute activities on on-premise resources or AWS resources that you manage?

  A. By supplying a Task Runner package that can be installed on your on-premise hosts

  B. None of these

  C. By supplying a Task Runner file that the resources can access for execution

  D. By supplying a Task Runner json script that can be installed on your on-premise hosts

  Correct Answer: A

  To enable running activities using on-premise resources, AWS Data Pipeline does the following: It supply a Task Runner package that can be installed on your on-premise hosts. This package continuously polls the AWS Data Pipeline service for work to perform. When it's time to run a particular activity on your on-premise resources, it will issue the appropriate command to the Task Runner.

  Reference: https://aws.amazon.com/datapipeline/faqs/

• Question 704:

  AWS has launched T2 instances which come with CPU usage credit. An organization has a requirement which keeps an instance running for 24 hours. However, the organization has high usage only during 11 AM to 12 PM. The organization is planning to use a T2 small instance for this purpose.

  If the organization already has multiple instances running since Jan 2012, which of the below mentioned options should the organization implement while launching a T2 instance?

  A. The organization must migrate to the EC2-VPC platform first before launching a T2 instance.

  B. While launching a T2 instance the organization must create a new AWS account as this account does not have the EC2-VPC platform.

  C. Create a VPC and launch a T2 instance as part of one of the subnets of that VPC.

  D. While launching a T2 instance the organization must select EC2-VPC as the platform.

  Correct Answer: C

  A Virtual Private Cloud (VPC) is a virtual network dedicated to the user's AWS account. The user can create subnets as per the requirement within a VPC. The AWS account provides two platforms: EC2-CLASSIC and EC2-VPC, depending on when the user has created his AWS account and which regions he is using. If the user has created the AWS account after 2013-12-04, it supports only EC2-VPC. In this scenario, since the account is before the required date the supported platform will be EC2CLASSIC. It is required that the organization creates a VPC as the T2 instances can be launched only as a part of VPC.

  Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-migrate.html

• Question 705:

  When using Numeric Conditions within IAM, short versions of the available comparators can be used instead of the more verbose versions.

  Which of the following is the short version of the Numeric Condition "NumericLessThanEquals"?

  A. numlteq

  B. numlteql

  C. numltequals

  D. numeql

  Correct Answer: A

  When using Numeric Conditions within IAM, short versions of the available comparators can be used instead of the more verbose versions. For instance, numIteq is the short version of NumericLessThanEquals.

  Reference: http://awsdocs.s3.amazonaws.com/SQS/2011-10-01/sqs-dg-2011-10-01.pdf

• Question 706:

  In Amazon Cognito what is a silent push notification?

  A. It is a push message that is received by your application on a user's device that will not be seen by the user.

  B. It is a push message that is received by your application on a user's device that will return the user's geolocation.

  C. It is a push message that is received by your application on a user's device that will not be heard by the user.

  D. It is a push message that is received by your application on a user's device that will return the user's authentication credentials.

  Correct Answer: A

  Amazon Cognito uses the Amazon Simple Notification Service (SNS) to send silent push notifications to devices. A silent push notification is a push message that is received by your application on a user's device that will not be seen by the user.

  Reference: http://aws.amazon.com/cognito/faqs/

• Question 707:

  In the context of Amazon ElastiCache CLI, which of the following commands can you use to view all ElastiCache instance events for the past 24 hours?

  A. elasticache-events --duration 24

  B. elasticache-events --duration 1440

  C. elasticache-describe-events --duration 24

  D. elasticache describe-events --source-type cache-cluster --duration 1440

  Correct Answer: D

  In Amazon ElastiCache, the code "aws elasticache describe-events --source-type cache-cluster -- duration 1440" is used to list the cache-cluster events for the past 24 hours (1440 minutes).

  Reference: http://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/ECEvents.Viewing.html

• Question 708:

  In the context of IAM roles for Amazon EC2, which of the following NOT true about delegating permission to make API requests?

  A. You cannot create an IAM role.

  B. You can have the application retrieve a set of temporary credentials and use them.

  C. You can specify the role when you launch your instances.

  D. You can define which accounts or AWS services can assume the role.

  Correct Answer: A

  Amazon designed IAM roles so that your applications can securely make API requests from your instances, without requiring you to manage the security credentials that the applications use. Instead of creating and distributing your AWS credentials, you can delegate permission to make API requests using IAM roles as follows: Create an IAM role. Define which accounts or AWS services can assume the role. Define which API actions and resources the application can use after assuming the role. Specify the role when you launch your instances. Have the application retrieve a set of temporary credentials and use them.

  Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

• Question 709:

  Out of the striping options available for the EBS volumes, which one has the following disadvantage: 'Doubles the amount of I/O required from the instance to EBS compared to RAID 0, because you're mirroring all writes to a pair of volumes, limiting how much you can stripe.'?

  A. Raid 1

  B. Raid 0

  C. RAID 1+0 (RAID 10)

  D. Raid 2

  Correct Answer: C

  RAID 1+0 (RAID 10) doubles the amount of I/O required from the instance to EBS compared to RAID 0, because you're mirroring all writes to a pair of volumes, limiting how much you can stripe.

  Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/raid-config.html

• Question 710:

  Identify a true statement about using an IAM role to grant permissions to applications running on Amazon EC2 instances.

  A. When AWS credentials are rotated; developers have to update only the root Amazon EC2 instance that uses their credentials.

  B. When AWS credentials are rotated, developers have to update only the Amazon EC2 instance on which the password policy was applied and which uses their credentials.

  C. When AWS credentials are rotated, you don't have to manage credentials and you don't have to worry about long-term security risks.

  D. When AWS credentials are rotated, you must manage credentials and you should consider precautions for long-term security risks.

  Correct Answer: C

  Using IAM roles to grant permissions to applications that run on EC2 instances requires a bit of extra configuration. Because role credentials are temporary and rotated automatically, you don't have to manage credentials, and you don't have to worry about long-term security risks.

  Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/role-usecase-ec2app.html