Which AWS services or features can control VPC traffic? (Select TWO.)
Correct Answer: A,D
Explanation The AWS services or features that can control VPC traffic are security groups and network ACLs. Security groups are stateful firewalls that control the inbound and outbound traffic at the instance level. You can assign one or more security groups to each instance in a VPC, and specify the rules that allow or deny traffic based on the protocol, port, and source or destination. Network ACLs are stateless firewalls that control the inbound and outbound traffic at the subnet level. You can associate one network ACL with each subnet in a VPC, and specify the rules that allow or deny traffic based on the protocol, port, and source or destination. AWS Direct Connect, Amazon GuardDuty, and Amazon Connect are not services or features that can control VPC traffic. AWS Direct Connect is a service that establishes a dedicated network connection between your premises and AWS. Amazon GuardDuty is a service that monitors your AWS account and workloads for malicious or unauthorized activity. Amazon Connect is a service that provides a cloud-based contact center solution.
Question 172
Which tasks are the customer's responsibility, according to the AWS shared responsibility model? (Select TWO.)
Correct Answer: B,C
According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while the customer is responsible for the security in the cloud. This means that AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud, such as the global network, the hardware, the software, and the facilities. The customer is responsible for properly configuring the security of the provided service, such as the guest operating system, the application software, the data, and the network traffic. For abstracted services, such as Amazon RDS, AWS operates the infrastructure layer, the operating system, and the database software, while the customer is responsible for managing their data, classifying their assets, and using IAM tools to apply the appropriate permissions12. Therefore, the tasks that are the customer's responsibility are: * Perform client-side data encryption: The customer is responsible for encrypting their data before sending it to AWS, and decrypting it after receiving it from AWS. This ensures that the data is protected in transit and at rest. AWS provides various encryption options, such as AWS Key Management Service (AWS KMS), AWS CloudHSM, and AWS Certificate Manager (ACM)3. * Configure IAM credentials: The customer is responsible for creating and managing IAM users, groups, roles, and policies that control the access to AWS resources and services. IAM credentials include user names, passwords, access keys, and permissions4. The tasks that are not the customer's responsibility are: * Establish the global infrastructure: AWS is responsible for building and maintaining the global network of regions, availability zones, and edge locations that provide low latency, high availability, and fault tolerance for the AWS Cloud5. * Secure edge locations: AWS is responsible for protecting the physical security of the edge locations, which are sites that deliver cached content to end users with improved performance6. * Patch Amazon RDS DB instances: AWS is responsible for applying patches and updates to the operating system and the database software of the Amazon RDS DB instances, which are managed relational database service for MySQL, PostgreSQL, Oracle, SQL Server, and Amazon Aurora. References: * Shared Responsibility Model - Amazon Web Services (AWS) * Shared responsibility model - Amazon Web Services: Risk and Compliance * Encryption - Amazon Web Services (AWS) * What Is IAM? - AWS Identity and Access Management * Global Infrastructure - Amazon Web Services (AWS) * Amazon CloudFront Features - Content Delivery Network (CDN) * [What Is Amazon Relational Database Service (Amazon RDS)? - Amazon Relational Database Service]
Question 173
A company must archive Amazon S3 data that the company's business units no longer need to access. Which S3 storage class will meet this requirement MOST cost-effectively?
Correct Answer: C
S3 Glacier Deep Archive is Amazon S3's lowest-cost storage class and supports long-term retention and digital preservation for data that may be accessed once or twice in a year. It is designed for customers - particularly those in highly-regulated industries, such as the Financial Services, Healthcare, and Public Sectors - that retain data sets for 7-10 years or longer to meet regulatory compliance requirements. Customers can store large amounts of data at a very low cost, and reliably access it with a wait time of 12 hours3.
Question 174
Which AWS service is a continuous delivery and deployment solution?
Correct Answer: B
Explanation AWS CodePipeline is a continuous delivery and deployment service that automates the release process of software applications across different stages, such as source code, build, test, and deploy2. AWSAppSync, AWS Cloud9, and AWS CodeCommit are other AWS services related to application development, but they do not provide continuous delivery and deployment solutions34 .
Question 175
Which AWS service is a highly available and scalable DNS web service?
Correct Answer: C
Amazon Route 53 is a highly available and scalable DNS web service. It is designed to give developers and businesses an extremely reliable and cost-effective way to route end users to Internet applications by translating domain names into the numeric IP addresses that computers use to connect to each other2. Amazon Route 53 also offers other features such as health checks, traffic management, domain name registration, and DNSSEC3.
