Scenario practice questions

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent failures due to a single Availability Zone failing. Which solution is MOST resilient and cost-effective?

Trap 1: Use a larger instance type in the same Availability Zone

Does not provide multi-AZ resilience.

Trap 2: Use an Auto Scaling group with a single instance in each of three…

Overkill and more expensive; ALB is sufficient.

Trap 3: Migrate to a single larger instance in a different region

Not cost-effective and adds latency.

A
Use a larger instance type in the same Availability Zone
Why wrong: Does not provide multi-AZ resilience.
B
Use an Auto Scaling group with a single instance in each of three Availability Zones and a Network Load Balancer
Why wrong: Overkill and more expensive; ALB is sufficient.
C
Migrate to a single larger instance in a different region
Why wrong: Not cost-effective and adds latency.
D
Deploy EC2 instances across two Availability Zones and configure the ALB to distribute traffic
Provides fault isolation and load balancing across zones.

Question 2easymulti select

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Trap 1: Enable public accessibility for easy management.

Public accessibility increases exposure to attacks.

Trap 2: Use a single Availability Zone to reduce complexity.

This does not improve security; it reduces availability.

Trap 3: Grant direct IAM user access to the database.

Direct IAM user access is not a standard practice; use IAM database authentication with caution.

A
Enable public accessibility for easy management.
Why wrong: Public accessibility increases exposure to attacks.
B
Use a single Availability Zone to reduce complexity.
Why wrong: This does not improve security; it reduces availability.
C
Launch the RDS instance in a private subnet.
Placing the database in a private subnet restricts direct internet access.
D
Enable encryption at rest using AWS KMS.
Encryption at rest protects data if storage is compromised.
E
Grant direct IAM user access to the database.
Why wrong: Direct IAM user access is not a standard practice; use IAM database authentication with caution.

Question 3easymulti select

A company uses Amazon CloudWatch Logs to store application logs. The security team requires that all logs be encrypted at rest using a customer-managed AWS KMS key. Which THREE steps are necessary to meet this requirement? (Choose THREE.)

Trap 1: Enable encryption on each log stream individually.

Encryption is set at the log group level, not individual log streams.

Trap 2: Enable server-side encryption on the Amazon S3 bucket where logs…

Logs are stored in CloudWatch Logs, not S3 by default.

A
Grant the IAM role used by the application to write logs permission to use the KMS key (kms:Encrypt, kms:Decrypt).
The writer must have permissions to use the KMS key.
B
Associate the KMS key with the CloudWatch Logs log group by specifying the key ARN in the log group's settings.
The log group must be configured to use the KMS key.
C
Create a customer-managed AWS KMS key in the same region as the CloudWatch Logs log group.
A customer-managed KMS key is required for encryption at rest.
D
Enable encryption on each log stream individually.
Why wrong: Encryption is set at the log group level, not individual log streams.
E
Enable server-side encryption on the Amazon S3 bucket where logs are exported.
Why wrong: Logs are stored in CloudWatch Logs, not S3 by default.

Question 4hardmultiple choice

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every 365 days. Which type of KMS key should be used?

Trap 1: AWS owned key

AWS owned keys are not stored in your account and cannot be managed.

Trap 2: Custom key store backed by CloudHSM

Custom key stores do not support automatic key rotation.

Trap 3: AWS managed key (aws/s3)

AWS managed keys are rotated automatically, but you cannot control the rotation period; it is fixed at yearly.

A
AWS owned key
Why wrong: AWS owned keys are not stored in your account and cannot be managed.
B
Custom key store backed by CloudHSM
Why wrong: Custom key stores do not support automatic key rotation.
C
Customer managed key (CMK)
Customer managed keys allow you to enable automatic rotation with a customizable period (default 365 days).
D
AWS managed key (aws/s3)
Why wrong: AWS managed keys are rotated automatically, but you cannot control the rotation period; it is fixed at yearly.

Question 5mediummultiple choice

Refer to the exhibit. A DevOps engineer runs the above CloudWatch Logs Insights query on a log group containing application logs. The query returns an empty result set. The engineer knows that the application logs contain ERROR entries. Which of the following is the most likely cause?

Exhibit

CloudWatch Logs Insights query:
fields @timestamp, @message
| filter @message like /ERROR/
| stats count() by @timestamp
| sort @timestamp desc
| limit 20

Trap 1: The stats function cannot be used with the filter command.

Stats can be used after filter.

Trap 2: The log group does not have any log streams.

The engineer knows logs contain ERROR entries, so log streams exist.

Trap 3: The limit of 20 results is too low and the query times out.

Limit is fine, and timeout is not indicated.

A
The stats function cannot be used with the filter command.
Why wrong: Stats can be used after filter.
B
The log group does not have any log streams.
Why wrong: The engineer knows logs contain ERROR entries, so log streams exist.
C
The filter pattern is case-sensitive and the log entries use lowercase 'error'.
The 'like' operator is case-sensitive by default.
D
The limit of 20 results is too low and the query times out.
Why wrong: Limit is fine, and timeout is not indicated.