Which AWS service is used to provide encryption for Amazon EBS?
Correct Answer: C
AWS KMS is the service that is used to provide encryption for Amazon EBS. AWS KMS is a managed service that enables you to easily create and control the encryption keys used to encrypt your data. Amazon EBS uses AWS KMS to encrypt and decrypt your EBS volumes and snapshots. You can choose to use either the default AWS managed CMK or your own customer managed CMK for encryption. AWS KMS also provides features such as key rotation, audit logging, and access control policies to help you manage your encryption keys and protect your data12. The other services are not used to provide encryption for Amazon EBS. AWS Certificate Manager is a service that lets you provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services and your internal connected resources3. AWS Systems Manager is a service that provides a unified user interface to view and manage your AWS resources, automate common operational tasks, and apply compliance policies4. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Reference: Amazon EBS encryption, AWS Key Management Service, AWS Certificate Manager, AWS Systems Manager, [AWS Config]
Question 147
A customer runs an On-Demand Amazon Linux EC2 instance for 3 hours, 5 minutes, and 6 seconds. For how much time will the customer be billed?
Correct Answer: C
Amazon EC2 usage is calculated by either the hour or the second based on the size of the instance, operating system, and the AWS Region where the instances are launched. Pricing is per instance-hour consumed for each instance, from the time an instance is launched until it's terminated or stopped. Each partial instance- hour consumed is billed per-second for Linux instances and as a full hour for all other instance types1. Therefore, the customer will be billed for 3 hours and 6 minutes for running an On-Demand Amazon Linux EC2 instance for 3 hours, 5 minutes, and 6 seconds. References: Understand Amazon EC2 instance-hours billing
Question 148
A company wants to securely store Amazon RDS database credentials and automatically rotate user passwords periodically. Which AWS service or capability will meet these requirements?
Correct Answer: C
Explanation AWS Secrets Manager is a service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle1. Amazon S3 is a storage service that does not offer automatic rotation of credentials. AWS Systems Manager Parameter Store is a service that provides secure, hierarchical storage for configuration data management and secrets management2, but it does not offer automatic rotation of credentials. AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account3, but it does not store or rotate credentials.
Question 149
Which responsibility belongs to AWS when a company hosts its databases on Amazon EC2 instances?
Correct Answer: C
When a company hosts its databases on Amazon EC2 instances, AWS and the customer share the responsibility for the security and management of the database environment. According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while the customer is responsible for the security in the cloud. This means that AWS is responsible for protecting the infrastructure that runs the EC2 instances, such as the hardware, software, networking, and facilities. The customer is responsible for properly configuring the security of the provided service, such as the guest operating system, the database software, the data, and the network traffic12. One of the tasks that belongs to AWS when a company hosts its databases on Amazon EC2 instances is operating system patches. AWS provides regular updates and patches to the operating system of the EC2 instances, which are applied automatically by default. The customer can also choose to manually apply the patches or schedule them for a specific time window3. Operating system patches are important for maintaining the security and performance of the EC2 instances and the databases running on them. The other tasks that belong to AWS when a company hosts its databases on Amazon EC2 instances are: Operating system installations: AWS provides a variety of operating system options for the EC2 instances, such as Linux, Windows, and Amazon Linux. The customer can choose the operating system that best suits their database needs and AWS will install it on the EC2 instances4. Server maintenance: AWS performs regular maintenance and repairs on the physical servers that host the EC2 instances, ensuring that they are in optimal condition and have adequate power, cooling, and network connectivity5. Hardware lifecycle: AWS manages the lifecycle of the hardware that supports the EC2 instances, such as replacing faulty components, upgrading equipment, and decommissioning old servers. The tasks that do not belong to AWS when a company hosts its databases on Amazon EC2 instances are: Database backups: The customer is responsible for backing up their data and databases on the EC2 instances, using tools such as Amazon S3, Amazon EBS snapshots, or AWS Backup. Database backups are essential for data protection and recovery in case of failures or disasters. Database software patches: The customer is responsible for applying patches and updates to the database software on the EC2 instances, such as MySQL, PostgreSQL, Oracle, or SQL Server. Database software patches are important for fixing bugs, improving features, and addressing security vulnerabilities. Database software install: The customer is responsible for installing the database software on the EC2 instances, choosing the version and configuration that meets their requirements. AWS provides some preconfigured AMIs (Amazon Machine Images) that include common database software, or the customer can use their own custom AMIs. Reference: Shared Responsibility Model - Amazon Web Services (AWS) Shared responsibility model - Amazon Web Services: Risk and Compliance Patching Amazon EC2 instances - AWS Systems Manager Amazon EC2 FAQs - Amazon Web Services Maintenance and Retirements - Amazon Elastic Compute Cloud [Hardware Lifecycle - Amazon Web Services (AWS)] [Backing Up Your Data - Amazon Web Services (AWS)] [Database Patching - Amazon Web Services (AWS)] [Installing Database Software on Amazon EC2 Instances - Amazon Web Services (AWS)]
Question 150
A company needs to continuously monitor its environment to analyze network and account activity and identify potential security threats. Which AWS service should the company use to meet these requirements?
Correct Answer: D
Amazon GuardDuty is a service that provides intelligent threat detection and continuous monitoring for the AWS environment. It analyzes network and account activity using machine learning and threat intelligence to identify potential security threats, such as unauthorized access, compromised credentials, malicious hosts, and reconnaissance activities. It also generates detailed and actionable findings that can be viewed on the AWS Management Console or sent to other AWS services, such as Amazon CloudWatch Events and AWS Lambda, for further analysis or remediation. Amazon GuardDuty OverviewAWS Certified Cloud Practitioner - aws.amazon.com
