没有合适的资源?快使用搜索试试~ 我知道了~
首页AWS SAP.pdf
资源详情
资源评论
资源推荐

Vender:AWS
Exam Code:SAP
Question Num:270Q
1 Q.
Your website is serving on-demand training videos to your workforce. Videos are uploaded monthly in highresolution MP4 format. Your
workforce is distributed globally often on the move and using company-providedtablets that require the HTTP Live Streaming (HLS) protocol
to watch a video. Your company has no videotranscoding expertise and it required you may need to pay for a consultant.How do you implement
the most cost-efficient architecture without compromising high availability and quality ofvideo delivery’?
A. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number of nodes depending on
the length of the queue. EBS volumes to host videos and EBS snapshots to incrementally backup original files after a few days. CloudFront
to serve HLS transcoded videos from EC2.
B. Elastic Transcoder to transcode original high-resolution MP4 videos to HLS. EBS volumes to host videos and EBS snapshots to
incrementally backup original files after a few days. CloudFront to serve HLS transcoded videos from EC2.
C. Elastic Transcoder to transcode original high-resolution MP4 videos to HLS. S3 to host videos with Lifecycle Management to archive
original files to Glacier after a few days. CloudFront to serve HLS transcoded videos from S3.
D. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number of nodes depending on
the length of the queue. S3 to host videos with Lifecycle Management to archive all files to Glacier after a few days. CloudFront to serve
HLS transcoded videos from Glacier.
More Practice:
http://freecram.com/torrent/Amazon.AWS-Solutions-Architect-Professional.v2018-01-02.q100.html

Answer:C
2 Q.
Your team has a tomcat-based Java application you need to deploy into development, test and productionenvironments. After some research,
you opt to use Elastic Beanstalk due to its tight integration with yourdeveloper tools and RDS due to its ease of management. Your QA team
lead points out that you need to roll asanitized set of production data into your environment on a nightly basis. Similarly, other
software teams in yourorg want access to that same restored data via their EC2 instances in your VPC.The optimal setup for persistence and
security that meets the above requirements would be the following.
A. Create your RDS instance as part of your Elastic Beanstalk definition and alter its security group to allow access to it from hosts in
your application subnets.
B. Create your RDS instance separately and add its IP address to your application’s DB connection strings in your code Alter its security
group to allow access to it from hosts within your VPC’s IP address block.
C. Create your RDS instance separately and pass its DNS name to your app’s DB connection string as an environment variable. Create a
security group for client machines and add it as a valid source for DB traffic to the security group of the RDS instance itself.
D. Create your RDS instance separately and pass its DNS name to your’s DB connection string as an environment variable Alter its security
group to allow access to It from hosts in your application subnets.
Answer:A
limao:C
beanstalk部署模式
和dns的关系
SG-SG?

3 Q.
Your system recently experienced down time during the troubleshooting process. You found that a newadministrator mistakenly terminated
several production EC2 instances.Which of the following strategies will help prevent a similar situation in the future?The administrator
still must be able to:launch, start stop, and terminate development resources.launch and start production instances.
A. Create an IAM user, which is not allowed to terminate instances by leveraging production EC2 termination protection.
B. Leverage resource based tagging, along with an IAM user which can prevent specific users from terminating production, EC2 resources.
C. Leverage EC2 termination protection and multi-factor authentication, which together require users to authenticate before terminating
EC2 instances
D. Create an IAM user and apply an IAM role which prevents users from terminating production EC2 instances.
Answer:B
Explanation:
Working with volumes
When an API action requires a caller to specify multiple resources, you must create a policy statement that
allows users to access all required resources. If you need to use a Condition element with one or more of these
resources, you must create multiple statements as shown in this example.
The following policy allows users to attach volumes with the tag “volume_user=iam-user-name” to instances
with the tag “department=dev”, and to detach those volumes from those instances. If you attach this policy to an
IAM group, the aws:username policy variable gives each IAM user in the group permission to attach or detach
volumes from the instances with a tag named volume_user that has his or her IAM user name as a value.
{
“Version”: “2012-10-17”,
“Statement”: [{
“Effect”: “Allow”,
“Action”: [
“ec2:AttachVolume”,
“ec2:DetachVolume”
],
“Resource”: “arn:aws:ec2:us-east-1:123456789012:instance/*”,
leverage 利用
B.利用基于资源的标记,以及IAM用户,这可以防止特定用户终止生产EC2资源。

“Condition”: {“StringEquals”: {
“ec2:ResourceTag/department”: “dev”
}
}
},
{
“Effect”: “Allow”,
“Action”: [
“ec2:AttachVolume”,
“ec2:DetachVolume”
],
“Resource”: “arn:aws:ec2:us-east-1:123456789012:volume/*”,
“Condition”: {
“StringEquals”: {
“ec2:ResourceTag/volume_user”: “${aws:username}”
}
}
}
]
}
Launching instances (RunInstances)
The RunInstances API action launches one or more instances. RunInstances requires an AMI and creates an
instance; and users can specify a key pair and security group in the request. Launching into EC2-VPC requires
a subnet, and creates a network interface. Launching from an Amazon EBS-backed AMI creates a volume.
Therefore, the user must have permission to use these Amazon EC2 resources. The caller can also configure
the instance using optional parameters to RunInstances, such as the instance type and a subnet. You can
create a policy statement that requires users to specify an optional parameter, or restricts users to particular
values for a parameter. The examples in this section demonstrate some of the many possible ways that you
can control the configuration of an instance that a user can launch.
Note that by default, users don’t have permission to describe, start, stop, or terminate the resulting instances.
One way to grant the users permission to manage the resulting instances is to create a specific tag for each
instance, and then create a statement that enables them to manage instances with that tag. For more
information, see 2: Working with instances.
a. AMI
The following policy allows users to launch instances using only the AMIs that have the specified tag,
“department=dev”, associated with them. The users can’t launch instances using other AMIs because the
Condition element of the first statement requires that users specify an AMI that has this tag. The users also
can’t launch into a subnet, as the policy does not grant permissions for the subnet and network interface
resources. They can, however, launch into EC2-Classic. The second statement uses a wildcard to enable users
to create instance resources, and requires users to specify the key pair project_keypair and the security group
sg-1a2b3c4d. Users are still able to launch instances without a key pair.
{

“Version”: “2012-10-17”,
“Statement”: [{
“Effect”: “Allow”,
“Action”: “ec2:RunInstances”,
“Resource”: [
“arn:aws:ec2:region::image/ami-*”
],
“Condition”: {
“StringEquals”: {
“ec2:ResourceTag/department”: “dev”
}
}
},
{
“Effect”: “Allow”,
“Action”: “ec2:RunInstances”,
“Resource”: [
“arn:aws:ec2:region:account:instance/*”,”arn:aws:ec2:region:account:volume/*”,
“arn:aws:ec2:region:account:key-pair/project_keypair”,
“arn:aws:ec2:region:account:security-group/sg-1a2b3c4d”
]
}
]
}
Alternatively, the following policy allows users to launch instances using only the specified AMIs, ami-9e1670f7
and ami-45cf5c3c. The users can’t launch an instance using other AMIs (unless another statement grants the
users permission to do so), and the users can’t launch an instance into a subnet.
{
“Version”: “2012-10-17”,
“Statement”: [{
“Effect”: “Allow”,
“Action”: “ec2:RunInstances”,
“Resource”: [
“arn:aws:ec2:region::image/ami-9e1670f7”,
“arn:aws:ec2:region::image/ami-45cf5c3c”,
“arn:aws:ec2:region:account:instance/*”,
“arn:aws:ec2:region:account:volume/*”,
“arn:aws:ec2:region:account:key-pair/*”,
“arn:aws:ec2:region:account:security-group/*”
]
}
]
剩余277页未读,继续阅读
















安全验证
文档复制为VIP权益,开通VIP直接复制

评论0