Exam 2

Question 1

Which section of a CloudFormation template does not allow for conditions?

Answer 1

Parameters

Question 2

Describe how KMS Encryption works?

Answer 2

• KMS stores the Customer Master Key
• KMS receives data from client
• KMS encrypts data and sends it back

Question 3

What must you ensure when using Exported Output Values in Cloudformation?

Answer 3

You must ensure that Exported Output Values have unique names within a single region.

Question 4

What service would you use if you would like to deploy an application to a Docker container in AWS?

Answer 4

ECS

Question 5

What record would you create to point a domain such as yourapp.3rdparty.com to a custom domain such as www.mydomain.com in Route53?

Answer 5

Create a CNAME record.

Question 6

If you create a Map of all the possible values for a base AMI for your EC2 instances, how should you invoke the !FindInMap function?

Answer 6

!FindInMap [ MapName, TopLevelKey, SecondLevelKey ]

Question 7

What service would you use to debug and trace data across accounts and visualize it in a centralized account?

Answer 7

X-Ray

Question 8

How do you control access to specific Lambda functions if they are all accessible via a publicly available API Gateway?

Answer 8

Use Lambda Authorizor which uses bearer token authentication strategies, such as OAuth or SAML. You have to create a Lambda function to implement this logic.

Question 9

If you enabled CloudWatch Logs for API Gateway but CloudWatch logs are not being written, what could be the cause?

Answer 9

You need to enable X-Ray intergration

Question 10

What is X-Ray sampling?

Answer 10

X-Ray SDK applies a sampling algorithm to determine which requests get traced

Question 11

How can you debug CodeBuild?

Answer 11

Run CodeBuild locally

Question 12

What service would you use to deploy new versions of your Lambda function and shift traffic to them?

Answer 12

CodeDeploy

Question 13

What service will help you with JWT handling and validation?

Answer 13

Cognito UserPools

Question 14

What does Cognito User Pool do?

Answer 14

After successfully authenticating a user, Amazon Cognito issues JSON web tokens (JWT) that you can use to secure and authorize access to your own APIs, or exchange for AWS credentials.

Question 15

What would you do if you need to perform many kinds of queries, using different attributes as query criteria in DynamoDB?

Answer 15

Create a GSI (Global Secondary Index)

Question 16

What should you do if SQS consumers take a long time to process messages and other consumers are receiving duplicate messages from the SQS queue?

Answer 16

Use ChangeMessageVisibility

Question 17

What service would you use if you want full control over deployment steps using blue-green deployment?

Answer 17

Code Deploy

Question 18

What service would you use to investigate why instances were terminated?

Answer 18

Cloudtrail

Question 19

What service would you use to control access to your API Gateway?

Answer 19

STS