Quizzes · The core four

Storage

Level 0 questions on Storage. Read the pillar first if it's new to you.

15 questions, from a pool of 41
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1A teammate created Todo.io's RDS database while the console was set to eu-west-1. The app runs in us-east-1 and can't find the database. Why?

RDS is a regional service: a database exists only in the Region it was created in.Correct. Most AWS services are regional. Always check the Region menu before you build or go looking.An SCP is hiding the database from us-east-1.Not this one. SCPs allow or deny API calls. They don't hide resources, and nothing is denied here.The database hasn't finished copying itself to the other Regions yet.Not this one. Nothing is copied between Regions unless you set it up (Level 3). The database will only ever be in eu-west-1.The database's Availability Zone is down.Not this one. Availability Zones are inside a Region. The database isn't in us-east-1 at all.

Learn it: Region · Set up AWS: Wrong Region

Question 2What does Amazon RDS do for Todo.io that running MySQL on its own EC2 instance would not?

AWS installs, patches and backs up the database for you.Correct. You still design tables and write SQL; RDS runs the database server.It removes the need for SQL.Not this one. RDS runs ordinary engines like MySQL and PostgreSQL; you still use SQL.It removes the need for security groups.Not this one. RDS runs in your VPC, and security groups still decide who can connect.It turns the database into HTTPS API calls with no connections.Not this one. That describes DynamoDB. With RDS you open normal database connections.

Learn it: RDS (Relational Database Service)

Question 3Todo.io's app can't connect to its RDS MySQL database: the connection times out. The password is correct. What is the most likely cause?

The database's security group doesn't allow inbound TCP 3306 from the app.Correct. A silent timeout is what a security group does with traffic it doesn't allow.The app's IAM role lacks permission to run SQL.Not this one. Connections to MySQL on RDS use a database username and password, and a wrong one is refused, not timed out.CloudTrail is blocking the connection.Not this one. CloudTrail only records; it never blocks.The database needs a public IP.Not this one. The app is in the same VPC and uses the private IP.

Learn it: Security group · RDS (Relational Database Service)

Question 4In Todo.io's Level 0 setup, how does the app prove who it is to its RDS MySQL database?

With a database username and password, over a normal connection on port 3306.Correct. RDS is connected to like any MySQL server. Keeping that password out of code is a Level 1 topic.Every SQL query is an HTTPS call signed with IAM, like DynamoDB.Not this one. That is how DynamoDB works, not MySQL.It doesn't; anything inside the VPC may connect.Not this one. The security group decides who may reach it, and the database still checks credentials.With the root user's access keys.Not this one. Root keys should never exist, and MySQL doesn't use them.

Learn it: RDS (Relational Database Service)

Question 5Todo.io is creating a single-AZ RDS database, but its DB subnet group must include subnets in at least two Availability Zones. Why?

So a standby in another Availability Zone can be added later without rebuilding.Correct. RDS insists on two AZs up front, even if you only use one today.Because the data is split across both AZs.Not this one. A single-AZ database keeps its data in one AZ.Because it is cheaper.Not this one. The subnet group costs nothing either way.So the database gets a public IP.Not this one. Public access is a separate setting, and a bad idea here.

Learn it: RDS (Relational Database Service) · Subnet

Question 6Someone ran DELETE FROM todos on Todo.io's RDS database. Will CloudTrail show who did it?

No. CloudTrail records AWS API calls, not the SQL run inside a database. The database's own logs would show it.Correct. CloudTrail would show CreateDBInstance or DeleteDBInstance, never what happens inside.Yes. CloudTrail records every SQL statement.Not this one. It never sees inside the database.Yes, but only with AWS Config turned on.Not this one. Config records resource settings, not queries.Yes, in CloudWatch metrics.Not this one. Metrics are numbers, such as connections or CPU, not who ran what.

Learn it: RDS (Relational Database Service) · CloudTrail

Question 7After Todo.io created its first RDS database, a role named AWSServiceRoleForRDS appeared. What is it?

A service-linked role that RDS uses to manage things like network interfaces for your databases.Correct. The service owns it: you can't change its permissions, and it only trusts RDS.A role someone created by mistake, which should be deleted.Not this one. RDS needs it. You can only delete it once RDS no longer uses it.The role the app uses to connect to the database.Not this one. The app connects with a database username and password.A role from IAM Identity Center.Not this one. Those are named AWSReservedSSO_…

Learn it: Service-linked role

Question 8A developer can create RDS databases, but creating one with an Enhanced Monitoring role fails with AccessDenied. What is missing?

Permission for iam:PassRole on the monitoring role.Correct. Handing a role to RDS is passing it, which needs iam:PassRole.The root user must create databases that have roles.Not this one. Root isn't needed; PassRole is.An SCP that allows RDS.Not this one. SCPs never grant anything.An inbound rule in the database's security group.Not this one. That is about network traffic, not about creating the database.

Learn it: iam:PassRole

Question 9Todo.io needs reports that join users, todos and tags with SQL. Which service fits?

Amazon RDS, a relational database.Correct. Joins across related tables are what relational databases are built for.Amazon DynamoDB.Not this one. DynamoDB finds items by key and has no SQL joins.Amazon S3.Not this one. S3 stores files, not related tables.Amazon SQS.Not this one. SQS holds messages waiting to be processed.

Learn it: RDS (Relational Database Service) · DynamoDB

Question 10Unlike DynamoDB, where does an Amazon RDS database run?

Inside your VPC, in your subnets, with security groups deciding who can connect.Correct. DynamoDB is reached through a public AWS endpoint instead.Outside the VPC, behind a public AWS endpoint.Not this one. That describes DynamoDB.Only in your own data centre.Not this one. RDS runs in AWS.Inside the Lambda function that uses it.Not this one. Databases run on their own; functions connect to them.

Learn it: RDS (Relational Database Service) · VPC (Virtual Private Cloud)

Question 11How does Todo.io's app read and write DynamoDB?

With HTTPS API calls such as GetItem and PutItem, each signed and checked by IAM.Correct. There is no server and no connection to open: every request is an AWS API call.Over a long-lived database connection on port 3306.Not this one. That is MySQL. DynamoDB has no connections.By mounting the table as a disk.Not this one. Tables are reached through the API, never mounted.Through a security group rule on the table.Not this one. DynamoDB has no security groups; IAM decides.

Learn it: DynamoDB

Question 12Todo.io's app gets AccessDeniedException when it calls PutItem on the Todos table. What should be fixed?

The app's role needs a policy allowing dynamodb:PutItem on the Todos table's ARN.Correct. IAM checks every DynamoDB request, and AccessDenied means no policy allowed it.The table's security group.Not this one. DynamoDB has no security groups.The database password.Not this one. DynamoDB has no passwords; requests are signed with IAM credentials.The table is full and must be resized.Not this one. A full-table problem wouldn't be AccessDenied.

Learn it: DynamoDB · IAM policy

Question 13Todo.io's app on EC2, in a public subnet, calls DynamoDB. Which way does the request travel?

Out through the internet gateway to DynamoDB's public AWS endpoint.Correct. DynamoDB isn't inside your VPC. A gateway endpoint (Level 1) can keep this traffic off the internet.Straight to the table inside the VPC.Not this one. Tables don't live in your VPC.Through the RDS database.Not this one. RDS and DynamoDB are unrelated.Through an SQS queue.Not this one. Queues pass messages between your own components.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · Internet gateway

Question 14Todo.io wants traffic from its VPC to DynamoDB to stay off the internet, without paying extra for it. What should it add?

A VPC gateway endpoint for DynamoDB.Correct. Gateway endpoints (for DynamoDB and S3) add a route to the service that never leaves AWS, and cost nothing.A NAT gateway.Not this one. A NAT gateway costs per hour and per GB, and the traffic still goes out to the public endpoint.A public IP on every instance.Not this one. That puts more traffic on the internet, not less.Move the table into the VPC.Not this one. DynamoDB tables can't be placed in a VPC.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · NAT gateway

Question 15How should Todo.io design a DynamoDB table so that reads are fast?

Around how it will read the data, so each read finds items by their key.Correct. DynamoDB finds items by key. Plan your keys from your queries, not the other way round.Like a relational schema, and join tables when reading.Not this one. DynamoDB has no joins.Any way at all, then scan the whole table each time.Not this one. Scans read everything, which is slow and expensive as tables grow.One item per table.Not this one. A table holds many items.

Learn it: DynamoDB

Question 16A Lambda function that isn't attached to a VPC writes to DynamoDB. Which security group is involved?

None. With no VPC there are no security groups, and DynamoDB has none either; IAM decides.Correct. Security groups only exist on network interfaces in a VPC.The VPC's default security group.Not this one. The function isn't in the VPC.The DynamoDB table's security group.Not this one. Tables have no security groups.The NAT gateway's security group.Not this one. There is no NAT gateway on this path, and NAT gateways don't take security groups.

Learn it: DynamoDB · Security group

Question 17Todo.io needs to store login sessions: millions of them, always looked up by session id, never joined to anything. Which service fits best?

Amazon DynamoDB.Correct. Lookups by key at any scale, with no server to run.Amazon RDS for MySQL.Not this one. It works, but you size and run a database server for something a key-value table does better.Amazon S3.Not this one. S3 stores files; it isn't built for fast small lookups.Amazon SQS.Not this one. A queue hands each message to one consumer once; it isn't a store you look things up in.

Learn it: DynamoDB

Question 18With DynamoDB, which of these does Todo.io manage?

Its tables, their keys, and who may access them.Correct. There are no servers. Data design and access are yours.The size of the database server.Not this one. There is no server to size.Operating system patches.Not this one. AWS runs everything underneath.A DB subnet group.Not this one. That is RDS. DynamoDB doesn't live in your subnets.

Learn it: DynamoDB

Question 19Todo.io created its Todos table in us-east-1. An app in eu-west-1 calls DynamoDB in eu-west-1 and gets ResourceNotFoundException. Why?

Tables are regional: Todos only exists in us-east-1.Correct. Call the us-east-1 endpoint, or copy the data across Regions (later levels).IAM blocks calls between Regions.Not this one. IAM is global, and this is "not found", not "denied".DynamoDB tables only exist in us-east-1.Not this one. You can create tables in any Region; this one was created in us-east-1.The table is still copying to eu-west-1.Not this one. Nothing is copied between Regions unless you set it up.

Learn it: Region · DynamoDB

Question 20A policy should cover only the Todos table, in us-east-1, in account 111122223333. Which Resource is right?

arn:aws:dynamodb:us-east-1:111122223333:table/TodosCorrect. Service, Region, account ID, then table/ and its name.arn:aws:s3:::TodosNot this one. That is the ARN of an S3 bucket named Todos.TodosNot this one. Policies name resources by ARN, not by bare name.arn:aws:dynamodb:::TodosNot this one. DynamoDB ARNs include the Region and account, and the table/ prefix.

Learn it: ARN (Amazon Resource Name)

Question 21Todo.io creates a bucket named todoio-pictures in eu-west-1. Which statement is true?

No one else in any AWS account can use that name, and the bucket's data lives in eu-west-1.Correct. Bucket names are globally unique, but every bucket lives in one Region.The name only has to be unique within Todo.io's account.Not this one. Names are unique across all of AWS.The bucket exists in every Region.Not this one. It lives in the Region you created it in.The name only has to be unique within eu-west-1.Not this one. Names are unique across every Region.

Learn it: S3 (Simple Storage Service)

Question 22What kind of storage is Amazon S3?

Object storage: files (objects) kept in buckets and read and written over HTTPS.Correct. S3 is not a disk you mount and not a database; you put and get whole objects.Block storage: a disk you attach to an EC2 instance.Not this one. That is EBS (Level 1).A relational database.Not this one. That is RDS.A message queue.Not this one. That is SQS.

Learn it: S3 (Simple Storage Service)

Question 23Is Amazon S3 inside Todo.io's VPC?

No. S3 is a public AWS service; traffic reaches it through the internet gateway, a NAT gateway or a gateway endpoint.Correct. Like DynamoDB and SQS, S3 sits outside every customer VPC.Yes. Each subnet has its own copy of every bucket.Not this one. Buckets live in a Region, not in subnets.Only in private subnets.Not this one. S3 isn't in any of your subnets.Only Lambda can reach S3.Not this one. Anything with permission and a network path can.

Learn it: VPC (Virtual Private Cloud) · S3

Question 24Todo.io creates a new S3 bucket and changes no settings. Can someone on the internet read its objects?

No. New buckets are private, with Block Public Access turned on.Correct. Making anything public takes deliberate steps, which Level 1 covers.Yes, anyone with the URL.Not this one. Nothing in a new bucket is public.They can list the objects but not read them.Not this one. They can do neither.Only from us-east-1.Not this one. Where the reader is doesn't matter; the bucket is private.

Learn it: S3 (Simple Storage Service)

Question 25Todo.io's pictures grow by about 1 TB a month. What must Todo.io do about S3 capacity?

Nothing. S3 grows as you add objects, and you pay for what you store.Correct. There is no size to choose and no disk to fill.Choose a bucket size and enlarge it each month.Not this one. Buckets have no size setting.Create a new bucket for every terabyte.Not this one. One bucket can hold any amount of data.Ask AWS for more capacity each month.Not this one. Storage isn't something you request.

Learn it: S3 (Simple Storage Service)

Question 26In S3, what is an object's key?

Its full name inside the bucket, such as pictures/u-123/avatar.png.Correct. Bucket plus key identifies one object. The slashes are just part of the name.The encryption key that protects it.Not this one. Encryption keys are a separate topic (Level 1).The access key used to upload it.Not this one. Access keys are credentials, not object names.The Region the object is stored in.Not this one. The Region belongs to the bucket.

Learn it: S3 (Simple Storage Service)

Question 27Todo.io's auditors ask who downloaded a file from an S3 bucket last week. CloudTrail is on with its default settings. Will it have that?

No. Object reads are data events, which CloudTrail doesn't log by default. They have to be turned on.Correct. By default CloudTrail logs management events, such as creating a bucket, not every object read.Yes. CloudTrail logs every object read by default.Not this one. Only management events are logged by default.Yes, in CloudWatch Logs.Not this one. CloudWatch Logs holds what applications print, not who read an object.No. S3 object reads can never be recorded.Not this one. They can, once CloudTrail data events are turned on.

Learn it: CloudTrail

Question 28A teammate asks what controls who can read objects in an S3 bucket. Which answer is right?

IAM policies on the caller, and the bucket policy on the bucket itself (a resource-based policy).Correct. The bucket policy names who may use the bucket. Block Public Access can override any rule that would make it public.A security group on the bucket.Not this one. Buckets have no security groups.The subnet the bucket is in.Not this one. Buckets aren't in subnets.IAM Identity Center.Not this one. Identity Center gives people roles in accounts; it doesn't set bucket permissions.

Learn it: S3 (Simple Storage Service) · IAM policy

Question 29Which of Todo.io's data belongs in S3?

Profile pictures and other uploaded files.Correct. Whole files read and written as one piece are what object storage is for.Todo rows that reports join with users and tags.Not this one. Related rows and joins belong in a relational database such as RDS.Jobs waiting for a worker.Not this one. Work waiting to be done belongs in a queue such as SQS.Login sessions looked up by id thousands of times a second.Not this one. Fast lookups by key belong in DynamoDB.

Learn it: S3 (Simple Storage Service)

Question 30What is the ARN of an S3 bucket named todoio-pictures?

arn:aws:s3:::todoio-picturesCorrect. Bucket names are globally unique, so S3 bucket ARNs leave out the Region and the account ID.arn:aws:s3:eu-west-1:111122223333:todoio-picturesNot this one. Most ARNs have a Region and account; S3 bucket ARNs don't.s3://todoio-picturesNot this one. That is the address the CLI uses, not an ARN.arn:aws:s3:::bucket/todoio-picturesNot this one. There is no bucket/ prefix.

Learn it: ARN (Amazon Resource Name) · S3

Question 31Todo.io's app on EC2 swaps its RDS MySQL database for a DynamoDB table. With RDS, access came down to the database's security group and a password. What decides whether the app may write to the table now?

IAM: the instance's role must allow writes (like dynamodb:PutItem) on the table's ARN.Correct. Every DynamoDB read and write is a signed API call approved by IAM. No connections, passwords or security groups are involved.The table's security group must let the app's security group in.Not this one. DynamoDB has no security groups: it's reached over HTTPS at a public endpoint, and IAM approves each call.A database password, kept somewhere safe and sent with each request.Not this one. DynamoDB has no passwords. The app's role signs each request, and IAM decides.The route table of the app's subnet.Not this one. A route table decides where traffic goes, not whether a call is allowed. Without permission, DynamoDB answers AccessDenied whatever the route.

Learn it: DynamoDB · RDS (Relational Database Service) · EC2 (Elastic Compute Cloud) · IAM policy

Question 32Todo.io needs SQL reports with joins, so it moves its todos from DynamoDB to RDS MySQL. DynamoDB lived outside the VPC. Where does the new database go?

Inside the VPC, in private subnets, with a security group that only lets the app in.Correct. RDS runs inside your VPC, unlike DynamoDB. Databases go in private subnets with no route to the internet.Outside the VPC, like DynamoDB: RDS is a public AWS service too.Not this one. RDS runs inside your VPC, in your subnets. That's one of the biggest differences from DynamoDB.In a public subnet, so the app can reach it over the internet.Not this one. A database should never have a route to the internet. The app reaches it inside the VPC.Outside the VPC, reached through a free gateway endpoint.Not this one. Gateway endpoints exist only for S3 and DynamoDB, and RDS lives inside the VPC anyway.

Learn it: RDS (Relational Database Service) · Subnet · VPC (Virtual Private Cloud)

Question 33What does "RDS (Relational Database Service)" mean?

A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.Correct. Think of it as: A filing cabinet with a librarian AWS employs.A fully managed NoSQL database you use through AWS API calls.Not this one. That describes DynamoDB.Unlimited storage for files ("objects") in containers called buckets.Not this one. That describes S3 (Simple Storage Service).The permission to hand an existing role to an AWS service.Not this one. That describes iam:PassRole.

Learn it: RDS (Relational Database Service)

Question 34Which term is this? "A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you."

RDS (Relational Database Service)Correct. Yes. Think of it as: A filing cabinet with a librarian AWS employs.DynamoDBNot this one. DynamoDB is: A fully managed NoSQL database you use through AWS API calls.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service.

Learn it: RDS (Relational Database Service)

Question 35Which AWS term is described by this analogy? "A filing cabinet with a librarian AWS employs."

RDS (Relational Database Service)Correct. Yes: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.DynamoDBNot this one. DynamoDB is: A fully managed NoSQL database you use through AWS API calls. Its analogy: A giant labelled locker wall where you fetch lockers by their exact key.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets. Its analogy: A warehouse of labelled boxes you can reach from anywhere.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service. Its analogy: Being allowed to lend your colleague's key card to a contractor.

Learn it: RDS (Relational Database Service)

Question 36What does "DynamoDB" mean?

A fully managed NoSQL database you use through AWS API calls.Correct. Think of it as: A giant labelled locker wall where you fetch lockers by their exact key.A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.Not this one. That describes RDS (Relational Database Service).Unlimited storage for files ("objects") in containers called buckets.Not this one. That describes S3 (Simple Storage Service).The permission to hand an existing role to an AWS service.Not this one. That describes iam:PassRole.

Learn it: DynamoDB

Question 37Which term is this? "A fully managed NoSQL database you use through AWS API calls."

DynamoDBCorrect. Yes. Think of it as: A giant labelled locker wall where you fetch lockers by their exact key.RDS (Relational Database Service)Not this one. RDS (Relational Database Service) is: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service.

Learn it: DynamoDB

Question 38Which AWS term is described by this analogy? "A giant labelled locker wall where you fetch lockers by their exact key."

DynamoDBCorrect. Yes: A fully managed NoSQL database you use through AWS API calls.RDS (Relational Database Service)Not this one. RDS (Relational Database Service) is: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you. Its analogy: A filing cabinet with a librarian AWS employs.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets. Its analogy: A warehouse of labelled boxes you can reach from anywhere.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service. Its analogy: Being allowed to lend your colleague's key card to a contractor.

Learn it: DynamoDB

Question 39What does "S3 (Simple Storage Service)" mean?

Unlimited storage for files ("objects") in containers called buckets.Correct. Think of it as: A warehouse of labelled boxes you can reach from anywhere.A fully managed NoSQL database you use through AWS API calls.Not this one. That describes DynamoDB.A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.Not this one. That describes RDS (Relational Database Service).Where applications and AWS services send their log lines.Not this one. That describes CloudWatch Logs.

Learn it: S3 (Simple Storage Service)

Question 40Which term is this? "Unlimited storage for files ("objects") in containers called buckets."

S3 (Simple Storage Service)Correct. Yes. Think of it as: A warehouse of labelled boxes you can reach from anywhere.DynamoDBNot this one. DynamoDB is: A fully managed NoSQL database you use through AWS API calls.RDS (Relational Database Service)Not this one. RDS (Relational Database Service) is: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.CloudWatch LogsNot this one. CloudWatch Logs is: Where applications and AWS services send their log lines.

Learn it: S3 (Simple Storage Service)

Question 41Which AWS term is described by this analogy? "A warehouse of labelled boxes you can reach from anywhere."

S3 (Simple Storage Service)Correct. Yes: Unlimited storage for files ("objects") in containers called buckets.DynamoDBNot this one. DynamoDB is: A fully managed NoSQL database you use through AWS API calls. Its analogy: A giant labelled locker wall where you fetch lockers by their exact key.RDS (Relational Database Service)Not this one. RDS (Relational Database Service) is: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you. Its analogy: A filing cabinet with a librarian AWS employs.CloudWatch LogsNot this one. CloudWatch Logs is: Where applications and AWS services send their log lines. Its analogy: The building's logbook.

Learn it: S3 (Simple Storage Service)

Storage

Score by pillar

Score by domain

Worth another look

Your weak spots

Services

Concepts