AWS Certified Developer - Associate Questions and Answers (Dumps and Practice Questions)
Question : You have following ClopudTrail log entry, which exist for
{ "Records": [ { "eventVersion": "1.01",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::123456789012:user/Alice",
"accountId": "123456789012",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
}, "eventTime": "2014-07-16T00:44:19Z",
"eventSource": "sqs.amazonaws.com",
"eventName": "AddPermission",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0",
"requestParameters": {
"actions": [
"SendMessage"
], "aWSAccountIds": [
"123456789012"
], "label": "label",
"queueUrl": "http://test-sqs.amazon.com/123456789012/hello1"
}, "responseElements": null,
"requestID": "334ccccd-b9bb-50fa-abdb-80f274981d60",
"eventID": "0552b000-09a3-47d6-a810-c5f9fd2534fe"
} ] }
1. AddPermission
2. CreateQueue
3. DeleteQueue
4. RemovePermission
5. SetQueueAttributes
Correct Answer : 1 CloudTrail log files contain one or more log entries where each entry is made up of multiple JSON-formatted events. A log entry represents a single request from any source and includes information about the requested action, any parameters, the date and time of the action, and so on. The log entries are not guaranteed to be in any particular order. That is, they are not an ordered stack trace of the public API calls. Every log entry contains information about who generated the request. The user identity information in the log helps you determine whether the request was made with root or IAM user credentials, with temporary security credentials for a role or federated user, or by another AWS service. For more information, see the userIdentity field in the CloudTrail Event Reference. You can store your log files in your bucket for as long as you want, but you can also define Amazon S3 lifecycle rules to archive or delete log files automatically. By default, your log files are encrypted by using Amazon S3 server-side encryption (SSE). You can choose to have CloudTrail publish Amazon SNS notifications when new log files are delivered if you want to take quick action upon log file delivery. For more information, see Configuring Amazon SNS Notifications. You can also aggregate Amazon SQS log files from multiple AWS regions and multiple AWS accounts into a single Amazon S3 bucket. For more information, see Aggregating CloudTrail Log Files to a Single Amazon S3 Bucket.
Question : Which of the following information can be included in an AMI?
1. A template for the root volume for the instance (for example, an operating system, an application server, and applications)
2. Launch permissions that control which AWS accounts can use the AMI to launch instances
3. A block device mapping that specifies the volumes to attach to the instance when it's launched
4. 1 and 2 only
5. All 1,2 and 3
Correct Answer :5
An Amazon Machine Image (AMI) provides the information required to launch an instance, which is a virtual server in the cloud. You specify an AMI when you launch an instance, and you can launch as many instances from the AMI as you need.
An AMI includes the following:
A template for the root volume for the instance (for example, an operating system, an application server, and applications)
Launch permissions that control which AWS accounts can use the AMI to launch instances
A block device mapping that specifies the volumes to attach to the instance when it's launched
Question :
If your requirement is to have fast re-boot and need more than 500GB storage, which type of AMI you will prefer
1. Amazon EBS-Backed
2. Amazon Instance Store-Backed
3. Any of the 1 and 2
4. None of the above
Correct Answer : 1 All AMIs are categorized as either backed by Amazon EBS or backed by instance store. The former means that the root device for an instance launched from the AMI is an Amazon EBS volume created from an Amazon EBS snapshot. The latter means that the root device for an instance launched from the AMI is an instance store volume created from a template stored in Amazon S3.
Characteristic
Boot time Amazon EBS-Backed : Usually less than 1 minute Amazon Instance Store-Backed : Usually less than 5 minutes
Size limit Amazon EBS-Backed : 1 TiB Amazon Instance Store-Backed : 10 GiB
Root device volume Amazon EBS-Backed : Amazon EBS volume Amazon Instance : Store-Backed Instance store volume
Data persistence Amazon EBS-Backed : Data on Amazon EBS volumes persists after instance termination*; you can also attach instance store volumes that don't persist after instance termination. Amazon Instance Store-Backed : Data on instance store volumes persists only during the life of the instance; you can also attach Amazon EBS volumes that persist after instance termination.
Upgrading Amazon EBS-Backed : The instance type, kernel, RAM disk, and user data can be changed while the instance is stopped. Amazon Instance Store-Backed : Instance attributes are fixed for the life of an instance.
Charges Amazon EBS-Backed : You're charged for instance usage, Amazon EBS volume usage, and storing your AMI as an Amazon EBS snapshot. Amazon Instance Store-Backed : You're charged for instance usage and storing your AMI in Amazon S3.
AMI creation/bundling Amazon EBS-Backed : Uses a single command/call Amazon Instance Store-Backed : Requires installation and use of AMI tools
Stopped state Amazon EBS-Backed : Can be placed in stopped state where instance is not running, but the root volume is persisted in Amazon EBS Amazon Instance Store-Backed : Cannot be in stopped state; instances are running or terminated
Related Questions
Question : With IAM, you can
1. centrally manage users
2. manage security credentials such as access keys
3. Access Mostly Uused Products by 50000+ Subscribers
4. 1 and 3
5. 1,2 and 3
Question :
In which of the following scenerio IAM migration is not possible
1. If Your organization has just a single AWS account.
2. If Your organization has multiple AWS accounts, with each AWS account belonging to a division in the organization
3. Access Mostly Uused Products by 50000+ Subscribers
4. None of the above
Question : Select the correct statement for the IAM ?
1. The organization need to have an individual AWS account per employee
2. AWS resources that your organization has already created can be moved to a different AWS account
3. Access Mostly Uused Products by 50000+ Subscribers
4. 1 and 2
5. 2 and 3
Question : Which of the following is incoorect ARNs for different types of IAM resources
1. arn:aws:iam::123456789012:root
2. arn:aws:iam::123456789012:user/Bob
3. Access Mostly Uused Products by 50000+ Subscribers
4. arn:aws:iam:123:456789012:group/Developers
5. arn:aws:iam::123456789012:group/division_abc/subdivision_xyz/product_A/Developers
Question :
The following example shows a policy you could assign to Bob to allow him to manage his own access keys
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["iam:*AccessKey*"],
"Resource": "arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/division_abc/subdivision_xyz/Bob"
}]
}
What is the resource in this example
1. iam
2. ACCOUNT-ID-WITHOUT-HYPHENS
3. Access Mostly Uused Products by 50000+ Subscribers
4. Resource is not correctly defined
5. Bob
Question : A corporate web application is deployed within an Amazon VPC, and is connected to the corporate data center via IPSec VPN. The application must authenticate against the
onpremise LDAP server. Once authenticated, logged-in users can only access an S3 keyspace specific to the user. Which two approaches can satisfy the objectives? Choose 2 answers
A. The application authenticates against LDAP. The application then calls the IAM Security Service to login to IAM using the LDAP credentials. The application can use the IAM
temporary credentials to access the appropriate S3 bucket.
B. The application authenticates against LDAP, and retrieves the name of an IAM role associated with the user. The application then calls the IAM Security Token Service to
assume that IAM Role. The application can use the temporary credentials to access the appropriate S3 bucket.
C. The application authenticates against IAM Security Token Service using the LDAP credentials. The application uses those temporary AWS security credentials to access the
appropriate S3 bucket.
D. Develop an identity broker which authenticates against LDAP, and then calls IAM Security Token Service to get IAM federated user credentials. The application calls the
identity broker to get IAM federated user credentials with access to the appropriate S3 bucket.
E. Develop an identity broker which authenticates against IAM Security Token Service to assume an IAM Role to get temporary AWS security credentials. The application calls the
identity broker to get AWS temporary security credentials with access to the appropriate S3 bucket.
1. A,B
2. B,C
3. Access Mostly Uused Products by 50000+ Subscribers
4. B,D
5. A,E