Amazon Amazon Certifications SAP-C01 Questions & Answers

• Question 721:

  An organization is planning to use NoSQL DB for its scalable data needs. The organization wants to host

  an application securely in AWS VPC.

  What action can be recommended to the organization?

  A. The organization should setup their own NoSQL cluster on the AWS instance and configure route tables and subnets.

  B. The organization should only use a DynamoDB because by default it is always a part of the default subnet provided by AWS.

  C. The organization should use a DynamoDB while creating a table within the public subnet.

  D. The organization should use a DynamoDB while creating a table within a private subnet.

  Correct Answer: A

  The Amazon Virtual Private Cloud (Amazon VPC) allows the user to define a virtual networking environment in a private, isolated section of the Amazon Web Services (AWS) cloud. The user has complete control over the virtual networking environment. Currently VPC does not support DynamoDB. Thus, if the user wants to implement VPC, he has to setup his own NoSQL DB within the VPC.

  Reference: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html

• Question 722:

  IAM users do not have permission to create Temporary Security Credentials for federated users and roles by default. In contrast, IAM users can call __________ without the need of any special permissions

  A. GetSessionName

  B. GetFederationToken

  C. GetSessionToken

  D. GetFederationName

  Correct Answer: C

  Currently the STS API command GetSessionToken is available to every IAM user in your account without previous permission. In contrast, the GetFederationToken command is restricted and explicit permissions need to be granted so a user can issue calls to this particular Action.

  Reference: http://docs.aws.amazon.com/STS/latest/UsingSTS/STSPermission.html

• Question 723:

  Regarding Identity and Access Management (IAM), Which type of special account belonging to your application allows your code to access Google services programmatically?

  A. Service account

  B. Simple Key

  C. OAuth

  D. Code account

  Correct Answer: A

  A service account is a special Google account that can be used by applications to access Google services programmatically. This account belongs to your application or a virtual machine (VM), instead of to an individual end user. Your application uses the service account to call the Google API of a service, so that the users aren't directly involved. A service account can have zero or more pairs of service account keys, which are used to authenticate to Google. A service account key is a public/private key pair generated by Google. Google retains the public key, while the user is given the private key.

  Reference: https://cloud.google.com/iam/docs/service-accounts

• Question 724:

  Within an IAM policy, can you add an IfExists condition at the end of a Null condition?

  A. Yes, you can add an IfExists condition at the end of a Null condition but not in all Regions.

  B. Yes, you can add an IfExists condition at the end of a Null condition depending on the condition.

  C. No, you cannot add an IfExists condition at the end of a Null condition.

  D. Yes, you can add an IfExists condition at the end of a Null condition.

  Correct Answer: C

  Within an IAM policy, IfExists can be added to the end of any condition operator except the Null condition. It can be used to indicate that conditional comparison needs to happen if the policy key is present in the context of a request; otherwise, it can be ignored.

  Reference:

  http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html

• Question 725:

  With respect to AWS Lambda permissions model, at the time you create a Lambda function, you specify an IAM role that AWS Lambda can assume to execute your Lambda function on your behalf. This role is also referred to as the________role.

  A. configuration

  B. execution

  C. delegation

  D. dependency

  Correct Answer: B

  Regardless of how your Lambda function is invoked, AWS Lambda always executes the function. At the time you create a Lambda function, you specify an IAM role that AWS Lambda can assume to execute your Lambda function on your behalf. This role is also referred to as the execution role.

  Reference: http://docs.aws.amazon.com/lambda/latest/dg/lambda-dg.pdf

• Question 726:

  Identify an application that polls AWS Data Pipeline for tasks and then performs those tasks.

  A. A task executor

  B. A task deployer

  C. A task runner

  D. A task optimizer

  Correct Answer: C

  A task runner is an application that polls AWS Data Pipeline for tasks and then performs those tasks. You can either use Task Runner as provided by AWS Data Pipeline, or create a custom Task Runner application. Task Runner is a default implementation of a task runner that is provided by AWS Data Pipeline. When Task Runner is installed and configured, it polls AWS Data Pipeline for tasks associated with pipelines that you have activated. When a task is assigned to Task Runner, it performs that task and reports its status back to AWS Data Pipeline. If your workflow requires non-default behavior, you'll need to implement that functionality in a custom task runner.

  Reference: http://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-how-remote-taskrunner-client.html

• Question 727:

  AWS Direct Connect itself has NO specific resources for you to control access to. Therefore, there are no AWS Direct Connect Amazon Resource Names (ARNs) for you to use in an Identity and Access Management (IAM) policy.

  With that in mind, how is it possible to write a policy to control access to AWS Direct Connect actions?

  A. You can leave the resource name field blank.

  B. You can choose the name of the AWS Direct Connection as the resource.

  C. You can use an asterisk (*) as the resource.

  D. You can create a name for the resource.

  Correct Answer: C

  AWS Direct Connect itself has no specific resources for you to control access to. Therefore, there are no AWS Direct Connect ARNs for you to use in an IAM policy. You use an asterisk (*) as the resource when writing a policy to control access to AWS Direct Connect actions.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/using_iam.html

• Question 728:

  Which of the following cannot be done using AWS Data Pipeline?

  A. Create complex data processing workloads that are fault tolerant, repeatable, and highly available.

  B. Regularly access your data where it's stored, transform and process it at scale, and efficiently transfer the results to another AWS service.

  C. Generate reports over data that has been stored.

  D. Move data between different AWS compute and storage services as well as on premise data sources at specified intervals.

  Correct Answer: C

  AWS Data Pipeline is a web service that helps you reliably process and move data between different AWS

  compute and storage services as well as on premise data sources at specified intervals. With AWS Data

  Pipeline, you can regularly access your data where it's stored, transform and process it at scale, and

  efficiently transfer the results to another AWS.

  AWS Data Pipeline helps you easily create complex data processing workloads that are fault tolerant,

  repeatable, and highly available. AWS Data Pipeline also allows you to move and process data that was

  previously locked up in on premise data silos.

  Reference:

  http://aws.amazon.com/datapipeline/

• Question 729:

  In Amazon RDS for PostgreSQL, you can provision up to 3TB storage and 30,000 IOPS per database instance. For a workload with 50% writes and 50% reads running on a cr1.8xlarge instance, you can realize over 25,000 IOPS for PostgreSQL. However, by provisioning more than this limit, you may be able to achieve:

  A. higher latency and lower throughput.

  B. lower latency and higher throughput.

  C. higher throughput only.

  D. higher latency only.

  Correct Answer: B

  You can provision up to 3TB storage and 30,000 IOPS per database instance. For a workload with 50% writes and 50% reads running on a cr1.8xlarge instance, you can realize over 25,000 IOPS for PostgreSQL. However, by provisioning more than this limit, you may be able to achieve lower latency and higher throughput. Your actual realized IOPS may vary from the amount you provisioned based on your database workload, instance type, and database engine choice.

  Reference: https://aws.amazon.com/rds/postgresql/

• Question 730:

  Select the correct statement about Amazon ElastiCache.

  A. It makes it easy to set up, manage, and scale a distributed in-memory cache environment in the cloud.

  B. It allows you to quickly deploy your cache environment only if you install software.

  C. It does not integrate with other Amazon Web Services.

  D. It cannot run in the Amazon Virtual Private Cloud (Amazon VPC) environment.

  Correct Answer: A

  ElastiCache is a web service that makes it easy to set up, manage, and scale a distributed in memory cache environment in the cloud. It provides a high-performance, scalable, and cost- effective caching solution, while removing the complexity associated with deploying and managing a distributed cache environment. With ElastiCache, you can quickly deploy your cache environment, without having to provision hardware or install software.

  Reference: http://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/WhatIs.html