AWS-Certified-Solutions-Architect-Professional Free Practice Test

In the context of AWS Cloud Hardware Security ModuIe(HSM), does your application need to reside in the same VPC as the CIoudHSM instance?

1. A. No, but the sewer or instance on which your application and the HSNI client is running must have network (IP) reachability to the HSNI.
2. B. Yes, always
3. C. No, but they must reside in the same Availability Zone.
4. D. No, but it should reside in same Availability Zone as the DB instanc

Correct Answer: A
Your application does not need to reside in the same VPC as the CIoudHSM instance.
However, the server or instance on which your application and the HSM client is running must have network (IP) reachability to the HSM. You can establish network connectMty in a variety of ways, including operating your application in the same VPC, with VPC peering, with a VPN connection, or with Direct Connect.
Reference: https://aws.amazon.com/cIoudhsm/faqs/

Is there any way to own a direct connection to Amazon Web Services?

1. A. No, AWS only allows access from the public Internet.
2. B. No, you can create an encrypted tunnel to VPC, but you cannot own the connection.
3. C. Yes, you can via Amazon Dedicated Connection.
4. D. Yes, you can via AWS Direct Connec

Correct Answer: D
AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard 1 gigabit or 10 gigabit Ethernet fiber-optic cable. One end of the cable is connected to your router, the other to an AWS Direct Connect router. With this connection in place, you can create virtual interfaces directly to the AWS cloud (for example, to Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Simple Storage Service (Amazon S3)) and to Amazon Virtual Private Cloud (Amazon VPC), bypassing Internet service providers in your network path.
Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

An enterprise wants to use a third-party SaaS application. The SaaS application needs to have access to issue several API commands to discover Amazon EC2 resources running within the enterprise's account The enterprise has internal security policies that require any outside access to their environment must conform to the principles of least prMlege and there must be controls in place to ensure that the credentials used by the SaaS vendor cannot be used by any other third party. Which of the following would meet all of these conditions?

1. A. From the AWS Management Console, navigate to the Security Credentials page and retrieve the access and secret key for your account.
2. B. Create an IAM user within the enterprise account assign a user policy to the IAM user that allows only the actions required by the SaaS application create a new access and secret key for the user and provide these credentials to the SaaS provider.
3. C. Create an IAM role for cross-account access allows the SaaS provider's account to assume the role and assign it a policy that allows only the actions required by the SaaS application.
4. D. Create an IAM role for EC2 instances, assign it a policy that allows only the actions required tor the Saas application to work, provide the role ARN to the SaaS provider to use when launching their application instances.

Correct Answer: C

When using Numeric Conditions within IAM, short versions of the available comparators can be used instead of the more verbose versions. Which of the following is the short version of the Numeric Condition "NumericLessThanEquaIs"?

1. A. numlteq
2. B. numlteql
3. C. numltequals
4. D. numeql

Correct Answer: A
When using Numeric Conditions within IAM, short versions of the available comparators can be used instead of the more verbose versions. For instance, numlteq is the short version of NumericLessThanEquaIs.
Reference: http://awsdocs.s3.amazonaws.com/SQS/2011-10-01/sqs-dg-2011-10-01.pdf

What types of identities do Amazon Cognito identity pools support?

1. A. They support both authenticated and unauthenticated identities.
2. B. They support only unauthenticated identities.
3. C. They support neither authenticated nor unauthenticated identities.
4. D. They support only authenticated identitie

Correct Answer: A
Amazon Cognito identity pools support both authenticated and unauthenticated identities. Authenticated identities belong to users who are authenticated by a public login provider or your own backend authentication process. Unauthenticated identities typically belong to guest users. Reference: http://docs.aws.amazon.com/cognito/devguide/identity/identity-poo|s/