AWS Sysops AA - ver 3

Create a stack

Configure a service

Create and upload the template

Provide the parameters configured as part of the template

The user should select all objects from the console and apply a single policy to mark them public

The user can write a program which programmatically makes all objects public using S3 SDK

Set the AWS bucket policy which marks all objects as public

Make the bucket ACL as public so it will also mark all objects as public

Stop one of the instances and change the availability zone

The zone can only be modified using the AWS CLI

From the AWS EC2 console, select the Actions – > Change zones and specify new zone

Create an AMI of the running instance and launch the instance in a separate AZ

ELB sends data to CloudWatch every minute only and does not charge the user

ELB will send data every minute and will charge the user extra

ELB is not supported by CloudWatch

It is not possible to setup detailed monitoring for ELB

3

0

5

2

The user should not use RI; instead only go with the on-demand pricing

The user should use the AWS high utilized RI

The user should use the AWS medium utilized RI

The user should use the AWS low utilized RI

The root account owner should create a bucket policy which allows the IAM users to upload the object

The root account owner should create the bucket policy which allows the other account owners to set the object policy of that bucket

The root account should use ACL with the bucket to allow everyone to upload the object

The root account should create the IAM users and provide them the permission to upload content to the bucket

Route 53

AWS Mechanical Turk

Auto Scaling

AWS EMR

The user can set the alarm state to `Alarm’ using CLI

Run the SNS action manually

From the AWS console change the state to `Alarm’

Run activities on the CPU such that its utilization reaches above 75%

AWS S3 with 1 GB of storage

AWS micro instance running 24 hours daily

AWS ELB running 24 hours a day

AWS PIOPS volume of 10 GB size

Delete the unutilized EBS volumes once the instance is terminated

Delete the AutoScaling launch configuration after the instances are terminated

Release the elastic IP if not required once the instance is terminated

Delete the AWS ELB after the instances are terminated

Allow Inbound traffic on port 22 from the user’s network

The user has to create an instance in EC2 Classic with an elastic IP and configure the security group of a private subnet to allow SSH from that elastic IP

The user can connect to a instance in a private subnet using the NAT instance

Allow Inbound traffic on port 80 and 22 to allow the user to connect to a private subnet over the Internet

Reduces the latency by splitting the workload across multiple AZs

A simple web services interface to create and store multiple data sets, query your data easily, and return the results

Offload the read traffic from your database in order to reduce latency caused by read-heavy workload

Managed service that makes it easy to set up, operate and scale a relational database in the cloud

The user can find the data by giving the exact values in the time Tab under CloudWatch metrics.

The user can find the data by filtering values of the last 1 week for a 1 hour period in the Relative tab under CloudWatch metrics.

It is not possible to find the exact time from the console. The user has to use CLI to provide the specific time.

The user can find the data by giving the exact values in the Absolute tab under CloudWatch metrics.

No, copy AMI does not copy the permission

It is not possible to share the AMI with a specific account

Yes, since copy AMI copies all private account sharing permissions

Yes, since copy AMI copies all the permissions attached with the AMI

Copy the running instance using the “Instance Copy” command to the EU region

Create an AMI of the instance and copy the AMI to the EU region. Then launch the instance from the EU AMI

Copy the instance from the US East region to the EU region

Use the “Launch more like this” option to copy the instance from one region to another

It is not possible to setup detailed monitoring for Auto Scaling

In this case, Auto Scaling will send data every minute and will charge the user extra

Detailed monitoring will send data every minute without additional charges

Auto Scaling sends data every minute only and does not charge the user

Auto Scaling will execute both processes but will add just one instance on the 1st

Auto Scaling will add two instances on the 1st of the month

Auto Scaling will schedule both the processes but execute only one process randomly

Auto Scaling will throw an error since there is a conflict in the schedule of two separate Auto Scaling Processes

3

5

2

1

It is not possible to get the notifications on a change in the security group

Configure SNS to monitor security group changes

Configure event notification on the DB security group

Configure the CloudWatch alarm on the DB for a change in the security group

The user should create a separate IAM user for each employee and provide access to them as per the policy

The user should create an IAM role and attach STS with the role. The user should attach that role to the EC2 instance and setup AWS authentication on that server

The user should create IAM groups as per the organization’s departments and add each user to the group for better access control

Attach an IAM role with the organization’s authentication service to authorize each user for various AWS services

Notify the Auto Scaling launch config to scale up

Send an SMS using SNS

Notify the Auto Scaling group to scale down

Stop the EC2 instance

There is no need for a security group modification as all the instances can communicate with each other inside the same subnet

Configure the subnet as the source in the security group and allow traffic on all the protocols and ports

Configure the security group itself as the source and allow traffic on all the protocols and ports

The user has to use VPC peering to configure this

Increase the desired capacity of the Auto Scaling group

Increase the maximum limit of the Auto Scaling group

Launch an instance manually and register it with ELB on the fly

Decrease the minimum limit of the Auto Scaling grou

Only the account that has purchased the RI will get the advantage of RI pricing

One instance of a small size and running in the US-East-1a zone of each AWS account will get the benefit of RI pricing

Any single instance from all the three accounts can get the benefit of AWS RI pricing if they are running in the same zone and are of the same size

If there are more than one instances of a small size running across multiple accounts in the same zone no one will get the benefit of RI

View the Auto Scaling CPU metrics

Aggregate the data over the instance AMI ID

The user has to use the CloudWatchanalyser to find the average data across instances

It is not possible to see the average CPU utilization of the same AMI ID since the instance ID is different

AWS S3

AWS Glacier

AWS RDS

AWS RRS

Setting up a NAT with the proxy protocol and configure that the public subnet receives traffic from NAT

Settin up a proxy policy in the internet gateway connected with the public subnet

It is not possible to setup the proxy policy for a public subnet

Setting the route table and security group of the public subnet which receives traffic from a virtual private gateway

In a Multi AZ, AWS runs two DBs in parallel and copies the data asynchronously to the replica copy

In a Multi AZ, AWS runs two DBs in parallel and copies the data synchronously to the replica copy

In a Multi AZ, AWS runs just one DB but copies the data synchronously to the standby replica copy

AWS MS SQL does not support the Multi AZ feature

ELB sticky session

ELB deregistration check

ELB connection draining

ELB auto registration Off

AWS Simple Notification Service

AWS Simple Workflow

AWS Simple Queue Service

AWS Simple Query Service

The user needs to use AWS CLI or API to upload the data

The user can use the AWS Import Export facility to import data to CloudWatch

The user will upload data from the AWS console

The user cannot upload data to CloudWatch since it is not an AWS service metric

ELB will ask the user whether to delete the instances or not

Instances will be terminated

ELB cannot be deleted if it has running instances registered with it

Instances will keep running

Use the IAM groups and add users as per their role to different groups and apply policy to group

The user can create a policy and apply it to multiple users in a single go with the AWS CLI

Add each user to the IAM role as per their organization role to achieve effective policy setupAdd each user to the IAM role as per their organization role to achieve effective policy setup

Use the IAM role and implement access at the role level

The user can use the CloudWatch Import tool

The user should be able to see the data in the console after around 15 minutes

If the user is uploading the custom data, the user must supply the namespace, timezone, and metric name as part of the command

The user can view as well as upload data using the console, CLI and APIs

The user should send only the data of the 60th second as CloudWatch will map the receive data timezone with the sent data timezone

It is not possible to send the custom metric to CloudWatch every minute

Give CloudWatch the Min, Max, Sum, and SampleCount of a number of every minute

Calculate the average of one minute and send the data to CloudWatch

http://sqs.us-east-1.amazonaws.com/123456789012/myqueue

http://sqs.amazonaws.com/123456789012/myqueue

http://sqs.123456789012.us-east-1.amazonaws.com/myqueue

http://123456789012.sqs.us-east-1.amazonaws.com/myqueue

RDS will have an internal IP which will redirect all requests to the new DB

RDS uses DNS to switch over to stand by replica for seamless transition

The switch over changes Hardware so RDS does not need to worry about access

RDS will have both the DBs running independently and the user has to manually switch over

Cloudformation follows the DevOps model for the creation of Dev & Test.

AWS Cloudfromation does not charge the user for its service but only charges for the AWS resources created with it.

Cloudformation works with a wide variety of AWS services, such as EC2, EBS, VPC, IAM, S3, RDS, ELB, etc.

CloudFormation provides a set of application bootstrapping scripts which enables the user to install Software.

Create a new stack within Opsworks add the appropriate layers to the stack and deploy the application.

Create a new application within Elastic Beanstalk and deploy this application to a new environment.

Launch a Mode JS server from a community AMI and manually deploy the application to the launched EC2 instance.

Launch and configure Chef Server on an EC2 instance and leverage the AWS CLI to launch application servers and configure those instances using Chef.

The IP of the primary DB instance is switched to the standby OB instance

The RDS (Relational Database Service) DB instance reboots

A new DB instance is created in the standby availability zone

The canonical name record (CNAME) is changed from primary to standby

Tag your resources with the application name, and select the tag name as the dimension in the Cloudwatch Management console to
view the respective graphs.

Use the Cloud Watch CLI tools to pull the respective metrics from each regional .endpointAggregate the data offline & store it for graphing in CloudWatch.

Add SNMP traps to each instance and DynamoDB table.
Leverage a central monitoring server to capture data from each instance and table.
Put the aggregate data into Cloud Watch for graphing.

When configuring the agent set the appropriate application name & view the graphs in CloudWatch.

The configuration of a MAT instance

The configuration of the Routing Table

The configuration of the internet Gateway (IGW)

The configuration of SRC’DST checking

Data transfer of an EC2 instance

Disk usage activity of an EC2 instance

Memory Utilization of an EC2 instance

CPU Utilization of an EC2mstance

Ensure the application instances are properly configured with an Elastic Load Balancer

Ensure the application instances are launched in private subnets with the EBS-optimized option enabled

Ensure the application instances are launched in public subnets with the associate-public-IP address=true option enabled

Launch application instances in private subnets with an Auto Scaling group and Auto Scaling triggers configured to watch the SQS queue size

Route53 record sets with weighted routing policy

Route53 record sets with latency based routing policy

Auto Scaling with scheduled scaling actions set

Elastic Load Balancing with health checks enabled

Use the S3 copy API to replicate data between two S3 buckets in different regions

You do not need to implement anything since S3 data is automatically replicated between regions

Use the S3 copy API to replicate data between two S3 buckets in different facilities within an AWS Region

You do not need to implement anything since S3 data is automatically replicated between multiple facilities within an AWS Region

Create a second, independent LOAP server in AWS for your application to use for authentication

Establish a VPN connection so your applications can authenticate against your existing on-premises LDAP servers

Establish a VPN connection between your data center and AWS create a LDAP replica on AWS and configure your application to use the LDAP replica for authentication

Create a second LDAP domain on AWS establish a VPN connection to establish a trust relationship between your new and existing domains and use the new domain for authentication

Consolidate your accounts so you have a single bill for all accounts and projects.

Set up auto scaling with CloudWatch alarms using SNS to notify you when you are running too many Instances in a given account.

Set up CloudWatch billing alerts for all AWS resources used by each project, with a notification occurring when the amount for each resource tagged to a particular project matches the budget allocated to the project.

Set up CloudWatch billing alerts for all AWS resources used by each account, with email notifications when it hits 50%. 80% and 90% of its budgeted monthly spend.

Create an IAM role with the Put MetricData permission and modify the Auto Scaling launch configuration to launch instances in that role

Create an IAM user with the PutMetricData permission and modify the Auto Scaling launch configuration to inject the userscredentials into the instance User Data

Modify the appropriate Cloud Watch metric policies to allow the Put MetricData permission to instances from the Auto Scaling group

Create an IAM user with the PutMetricData permission and put the credentials in a private repository and have applications on the server pull the credentials as needed

Each tag will have a key and value

The user can apply tags to the S3 bucket

The maximum value of the tag key length is 64 unicode characters

AWS tags are used to find the cost distribution of various resources

Programmatic access

AWS bucket to hold the billing report

AWS billing alerts

Monthly Billing report

SendMessageBatch

DeleteMessageBatch

CreateQueue

DeleteMessageQueue