AWS CDA Practice Tests UPDATED
ACTUAL Exam Questions and CORRECT
Answers
AWS CodeBuild Agent - CORRECT ANSWER - AWS CodeBuild is a fully managed
build service. With Local Build support for the AWS CodeBuild Agent you can run builds test
and debug on a local machine. There is no Detailed Monitoring for CodeBuild only EC2
instances, and it is not possible to SSH into any managed services only EC2.
Which AWS entities can be used to deploy SSL/TLS server certificates? - CORRECT
ANSWER - AWS Certificate Manager & IAM can be used to deploy SSL/TLS server
certificates for HTTPS connections on AWS. ACM is the preferred certificate manager with
IAM being used only when you must support HTTPS connections in a Region that is not
supported by ACM.
Limitations of IAM for SSL/TLS Certificate Management - CORRECT ANSWER - IAM
does not support:
* generating certificates like ACM, certificates must be provided from an external provider.
* ACM certificates cannot be uploaded to IAM
* certificates cannot be managed within IAM, only stored in the IAM SSL certificate storage.
A startup with newly created AWS account is testing different EC2 instances. They have used
Burstable performance instance - T2.micro - for 35 seconds and stopped the instance.
At the end of the month, what is the instance usage duration that the company is charged for? -
CORRECT ANSWER - AWS accounts less than 12 months old are allowed usage of a
t2.micro instance for free within certain usage limits.
Account would have been billed for 0 seconds due to the free tier.
Application Load Balancer Access Logs - CORRECT ANSWER - Elastic Load Balancing
provides access logs that capture detailed information about requests sent to your load balancer.
Access Logging is an optional feature of Elastic Load Balancing that is disabled by default.
,CloudFront Key Pairs - CORRECT ANSWER - CloudFront Key pairs are used to create
signed URLs for private content such as when you want to distribute restricted content that
someone paid for. IAM users cannot create CloudFront Key Pairs, you must login using root
credentials.
EC2 Instance Key Pairs - CORRECT ANSWER - EC2 Instance Key Pairs are used to
access EC2 instances, such as when you ssh to login to a Linux instance. IAM users can create
their own access keys they do not need root access.
IAM User Access Keys - CORRECT ANSWER - Access Keys consist of two parts: an
access key ID and a secret access key. You use access keys to sign programmatic requests that
you make to AWS if you use the AWS CLI or using AWS API operations. IAM users can create
their own access keys, they do not need root acccess.
Cognito Idenity Pools vs User Pools - CORRECT ANSWER - Identity Pools allow users
to obtain temporary AWS credential to access AWS services, User Pools are used for app
authentication through Amazon Cognito or a federated third party. Identity Pools think AWS,
User Pools think app identity.
A photo-sharing application manages its EC2 server fleet running behind an Application Load
Balancer and the traffic is fronted by a CloudFront distribution. The development team wants to
decouple the user authentication process for the application so that the application servers can
just focus on the business logic. - CORRECT ANSWER - Use Cognito Authentication via
Cognito User Pools for your Application Load Balancer.
There is no such thing as using Cognito Authentication via Cognito Identity Pools. Application
specific user authentication can be provided via Cognito User Pools.
You are a developer for a web application written in .NET which uses the AWS SDK. You need
to implement an authentication mechanism that returns a JWT (JSON Web Token). - CORRECT
ANSWER - Cognito User Pools return user pool tokens as JWTs. These can then be traded
for temp AWS credentials if desired.
Cognito Identity Pools provide temporary AWS credentials, as well as anonymous guest
credentials.
, Configuring HTTPS for Application Load Balancers - CORRECT ANSWER - To use an
HTTPS listener on ALB you must:
1) deploy at least one SSL/TLS server certificate via AWS Certificate Manager.
2) create an HTTPS listener on the Application Load Balancer with SSL termination.
Permissions Boundaries - CORRECT ANSWER - Permissions Boundaries define the
maximum permissions that an identity-based policy can grant to an entity. Permission
Boundaries but do not grant additional permissions, and they do not affect max permissions of
resource-based policies.
Organizations Service Control Policy (SCP) - CORRECT ANSWER - AWS Organizations
Service Control Policies (SCP) define the max permissions for account members of an
organization. SCPs limit permissions that identity and resource based policies grant to entities.
SCPs do not grant additional permissions.
CloudWatch vs CloudTrail vs Config - CORRECT ANSWER - CloudWatch vs
CloudTrail vs Config
* CloudWatch - Think resource performance monitoring, events, and alerts.
* CloudTrail - Think account specific activity and audit.
* Config - Think resource-specific history, audit, and compliance.
AWS Config - CORRECT ANSWER - AWS Config is a service that enables you to
assess, audit, and evaluate the configurations of your AWS resources. Use Config to dive into
resource configuration histories and determine overall compliance.
A developer at a company is trying to create a digital signature for SSH'ing into the Amazon
EC2 instances. - CORRECT ANSWER - Key pairs consist of a public + private key pair
used to create a digital signature. They only apply to EC2 and Amazon CloudFront.
Amazon Inspector - CORRECT ANSWER - Amazon Inspector is an automated security
assessment service that helps improve the security and compliance of applications deployed on
AWS by assessing apps for exposure, vulnerabilities, and deviations from best practice.
ACTUAL Exam Questions and CORRECT
Answers
AWS CodeBuild Agent - CORRECT ANSWER - AWS CodeBuild is a fully managed
build service. With Local Build support for the AWS CodeBuild Agent you can run builds test
and debug on a local machine. There is no Detailed Monitoring for CodeBuild only EC2
instances, and it is not possible to SSH into any managed services only EC2.
Which AWS entities can be used to deploy SSL/TLS server certificates? - CORRECT
ANSWER - AWS Certificate Manager & IAM can be used to deploy SSL/TLS server
certificates for HTTPS connections on AWS. ACM is the preferred certificate manager with
IAM being used only when you must support HTTPS connections in a Region that is not
supported by ACM.
Limitations of IAM for SSL/TLS Certificate Management - CORRECT ANSWER - IAM
does not support:
* generating certificates like ACM, certificates must be provided from an external provider.
* ACM certificates cannot be uploaded to IAM
* certificates cannot be managed within IAM, only stored in the IAM SSL certificate storage.
A startup with newly created AWS account is testing different EC2 instances. They have used
Burstable performance instance - T2.micro - for 35 seconds and stopped the instance.
At the end of the month, what is the instance usage duration that the company is charged for? -
CORRECT ANSWER - AWS accounts less than 12 months old are allowed usage of a
t2.micro instance for free within certain usage limits.
Account would have been billed for 0 seconds due to the free tier.
Application Load Balancer Access Logs - CORRECT ANSWER - Elastic Load Balancing
provides access logs that capture detailed information about requests sent to your load balancer.
Access Logging is an optional feature of Elastic Load Balancing that is disabled by default.
,CloudFront Key Pairs - CORRECT ANSWER - CloudFront Key pairs are used to create
signed URLs for private content such as when you want to distribute restricted content that
someone paid for. IAM users cannot create CloudFront Key Pairs, you must login using root
credentials.
EC2 Instance Key Pairs - CORRECT ANSWER - EC2 Instance Key Pairs are used to
access EC2 instances, such as when you ssh to login to a Linux instance. IAM users can create
their own access keys they do not need root access.
IAM User Access Keys - CORRECT ANSWER - Access Keys consist of two parts: an
access key ID and a secret access key. You use access keys to sign programmatic requests that
you make to AWS if you use the AWS CLI or using AWS API operations. IAM users can create
their own access keys, they do not need root acccess.
Cognito Idenity Pools vs User Pools - CORRECT ANSWER - Identity Pools allow users
to obtain temporary AWS credential to access AWS services, User Pools are used for app
authentication through Amazon Cognito or a federated third party. Identity Pools think AWS,
User Pools think app identity.
A photo-sharing application manages its EC2 server fleet running behind an Application Load
Balancer and the traffic is fronted by a CloudFront distribution. The development team wants to
decouple the user authentication process for the application so that the application servers can
just focus on the business logic. - CORRECT ANSWER - Use Cognito Authentication via
Cognito User Pools for your Application Load Balancer.
There is no such thing as using Cognito Authentication via Cognito Identity Pools. Application
specific user authentication can be provided via Cognito User Pools.
You are a developer for a web application written in .NET which uses the AWS SDK. You need
to implement an authentication mechanism that returns a JWT (JSON Web Token). - CORRECT
ANSWER - Cognito User Pools return user pool tokens as JWTs. These can then be traded
for temp AWS credentials if desired.
Cognito Identity Pools provide temporary AWS credentials, as well as anonymous guest
credentials.
, Configuring HTTPS for Application Load Balancers - CORRECT ANSWER - To use an
HTTPS listener on ALB you must:
1) deploy at least one SSL/TLS server certificate via AWS Certificate Manager.
2) create an HTTPS listener on the Application Load Balancer with SSL termination.
Permissions Boundaries - CORRECT ANSWER - Permissions Boundaries define the
maximum permissions that an identity-based policy can grant to an entity. Permission
Boundaries but do not grant additional permissions, and they do not affect max permissions of
resource-based policies.
Organizations Service Control Policy (SCP) - CORRECT ANSWER - AWS Organizations
Service Control Policies (SCP) define the max permissions for account members of an
organization. SCPs limit permissions that identity and resource based policies grant to entities.
SCPs do not grant additional permissions.
CloudWatch vs CloudTrail vs Config - CORRECT ANSWER - CloudWatch vs
CloudTrail vs Config
* CloudWatch - Think resource performance monitoring, events, and alerts.
* CloudTrail - Think account specific activity and audit.
* Config - Think resource-specific history, audit, and compliance.
AWS Config - CORRECT ANSWER - AWS Config is a service that enables you to
assess, audit, and evaluate the configurations of your AWS resources. Use Config to dive into
resource configuration histories and determine overall compliance.
A developer at a company is trying to create a digital signature for SSH'ing into the Amazon
EC2 instances. - CORRECT ANSWER - Key pairs consist of a public + private key pair
used to create a digital signature. They only apply to EC2 and Amazon CloudFront.
Amazon Inspector - CORRECT ANSWER - Amazon Inspector is an automated security
assessment service that helps improve the security and compliance of applications deployed on
AWS by assessing apps for exposure, vulnerabilities, and deviations from best practice.
