Quizzes · Service

EC2

Level 0 questions on EC2. Read about it first if it's new to you.

Works with: VPC (7), IAM (3), DynamoDB (2), CloudWatch Logs (2), ECS + Fargate (1), Lambda (1), RDS (1)

15 questions, from a pool of 19
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1A brand-new AWS account wants to launch an EC2 instance right away, without designing a network. Where can it go?

Into the default VPC that every account has in each Region, which already has public subnets.Correct. The default VPC lets you start straight away. Level 1 replaces it with a designed one.Nowhere, until a VPC has been created by hand.Not this one. Every account already has a default VPC in each Region.Outside any VPC, directly on the internet.Not this one. EC2 instances always live in a VPC.Only into us-east-1, where the account was created.Not this one. There is a default VPC in every Region.

Learn it: VPC (Virtual Private Cloud)

Question 2What does a security group attach to?

A network interface (ENI): the one on an EC2 instance, a Fargate task or a VPC-attached Lambda function.Correct. Security groups filter traffic at the network card, not at the subnet.A subnet.Not this one. Subnets don't take security groups. (Network ACLs attach to subnets, in Level 1.)The whole VPC.Not this one. Each network interface has its own security groups.A route table.Not this one. Route tables decide where traffic goes. They hold no rules about who may connect.

Learn it: ENI (Elastic Network Interface) · Security group

Question 3The Todo.io app runs on an EC2 instance and must write to a DynamoDB table. What is the most secure way to give it AWS credentials?

Attach an IAM role to the instance through an instance profile.Correct. The SDK fetches temporary credentials for the role from the instance itself, and they rotate automatically. There are no long-lived keys to leak.Create an IAM user's access keys and put them in the app's config file.Not this one. Long-lived keys in a file get copied, committed to Git and forgotten. Anyone who finds them has the access.Pass access keys to the instance in its user data.Not this one. User data is readable by anything on the instance and isn't secret. It's no safer than a config file.Use the root user's access keys, because they never expire.Not this one. Never expiring is the problem. Root keys should not exist at all.

Learn it: EC2 (Elastic Compute Cloud) · Temporary credentials · IAM role · Design Todo.io on EC2

Question 4Todo.io runs its app on EC2. A security patch for the operating system is released. Whose job is it to install it?

Todo.io's. On EC2, everything from the operating system up is the customer's job.Correct. This is the shared responsibility model: AWS runs the hardware and the hypervisor, you run what is on the instance.AWS's, automatically, for every instance.Not this one. AWS doesn't touch the operating system on your instances.Nobody's. EC2 instances never need patching.Not this one. They need patching like any server.Only the root user's, from the console.Not this one. Patching happens on the instance, by whoever runs it, not through the root user.

Learn it: EC2 (Elastic Compute Cloud)

Question 5Todo.io wants every new app server to start with the same operating system and the same software already installed. What should every launch use?

The same AMI (Amazon Machine Image).Correct. The AMI is the starting disk image: operating system plus whatever you baked in.The same instance type.Not this one. The instance type sets size (CPU and memory), not what is installed.The same security group.Not this one. That decides who can connect, not what runs.The same network interface.Not this one. Each instance gets its own; it carries addresses, not software.

Learn it: EC2 (Elastic Compute Cloud)

Question 6Todo.io's app server keeps running out of memory. What should Todo.io change?

The instance type, to one with more memory.Correct. The instance type sets how much CPU and memory the server has.The AMI.Not this one. The AMI decides the software, not the hardware.The subnet.Not this one. Moving subnets changes the network, not the server's size.The security group.Not this one. Security groups only filter traffic.

Learn it: EC2 (Elastic Compute Cloud)

Question 7A Linux test server runs for about 40 minutes a day and is stopped the rest of the time. How is it billed as an On-Demand instance?

Per second while it runs, with a one-minute minimum each time it starts.Correct. You rent EC2 by the second, so a stopped instance costs nothing for compute (its disk is still billed).A fixed monthly price, running or not.Not this one. That is closer to a Reserved Instance commitment, not On-Demand.Per hour, rounded up, for all instances.Not this one. Linux On-Demand instances are billed per second.Only while its CPU is busy.Not this one. You pay while it runs, busy or idle.

Learn it: EC2 (Elastic Compute Cloud)

Question 8Todo.io stopped and started its web server overnight. Now users can't reach it at the public IP address they had. What happened?

A normal public IP is released when an instance stops; it got a new one on start. An Elastic IP stays fixed.Correct. Inside the VPC the instance only knows its private IP. The public IP is mapped to it, and that mapping changes on stop and start.The security group was reset.Not this one. Security groups don't change when an instance stops.The subnet became private.Not this one. A subnet only changes if someone edits its route table.The internet gateway was removed.Not this one. Stopping an instance doesn't touch the gateway.

Learn it: Public IP address

Question 9Todo.io's app on EC2 has a role attached through an instance profile. Where does the AWS SDK get the role's credentials from?

From the instance metadata service at 169.254.169.254, on the instance's host.Correct. The SDK asks for temporary credentials and refreshes them before they expire. Nothing is stored in a file.From a file the team uploads to the instance.Not this one. That would be long-lived keys on disk, which roles exist to avoid.From an S3 bucket.Not this one. Credentials are never fetched from a bucket.From the IAM Identity Center access portal.Not this one. The portal is for people. Software on EC2 uses its instance profile.

Learn it: Temporary credentials · IAM role

Question 10An EC2 instance sits in a private subnet with no NAT gateway. It needs to download a software update from the internet. What happens?

The download fails: the subnet has no route out. A NAT gateway in a public subnet would give it one.Correct. Private means no route to the internet gateway. A NAT gateway lets it call out while nothing calls in.It works, because security groups allow all outbound traffic by default.Not this one. Security groups allow it, but there is no route for the traffic to take.It works if the instance has a public IP.Not this one. In a private subnet a public IP leads nowhere: there is still no route to the internet gateway.It works through the internet gateway automatically.Not this one. Only subnets whose route table points to the internet gateway use it.

Learn it: NAT gateway · Subnet

Question 11Todo.io's web server is in a public subnet and has a public IP, but users get a timeout on HTTPS (port 443). What should be checked first?

That the instance's security group allows inbound TCP 443.Correct. Security groups deny everything that isn't allowed. A missing inbound rule shows up as a timeout.That there is a NAT gateway.Not this one. NAT is for calling out from private subnets, not for being reached.That there is an outbound rule for the replies.Not this one. Security groups are stateful; replies are allowed automatically.That the instance is in a private subnet.Not this one. A private subnet would make it unreachable from the internet.

Learn it: Security group

Question 12Which of Todo.io's compute choices still leaves Todo.io patching an operating system?

Amazon EC2.Correct. With EC2 you get a server, and the operating system on it is yours to maintain.AWS Lambda.Not this one. Lambda has no server for you to manage.Amazon ECS on Fargate.Not this one. With Fargate, AWS runs and patches the servers under your containers.Amazon API Gateway.Not this one. It is a managed front door with nothing to patch.

Learn it: EC2 (Elastic Compute Cloud) · ECS and Fargate · Lambda

Question 13What does Amazon RDS do for Todo.io that running MySQL on its own EC2 instance would not?

AWS installs, patches and backs up the database for you.Correct. You still design tables and write SQL; RDS runs the database server.It removes the need for SQL.Not this one. RDS runs ordinary engines like MySQL and PostgreSQL; you still use SQL.It removes the need for security groups.Not this one. RDS runs in your VPC, and security groups still decide who can connect.It turns the database into HTTPS API calls with no connections.Not this one. That describes DynamoDB. With RDS you open normal database connections.

Learn it: RDS (Relational Database Service)

Question 14Todo.io's app on EC2, in a public subnet, calls DynamoDB. Which way does the request travel?

Out through the internet gateway to DynamoDB's public AWS endpoint.Correct. DynamoDB isn't inside your VPC. A gateway endpoint (Level 1) can keep this traffic off the internet.Straight to the table inside the VPC.Not this one. Tables don't live in your VPC.Through the RDS database.Not this one. RDS and DynamoDB are unrelated.Through an SQS queue.Not this one. Queues pass messages between your own components.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · Internet gateway

Question 15Todo.io's app on EC2 writes log files, but nothing shows up in CloudWatch Logs. What is needed?

Install the CloudWatch agent on the instance, and allow the instance's role to write logs.Correct. EC2 doesn't send logs by itself. Lambda and Fargate do, but an instance is your server.Nothing; EC2 sends every file automatically.Not this one. It sends nothing until the agent is set up.Turn on CloudTrail.Not this one. CloudTrail records API calls, not files on an instance.Open an inbound port on the instance.Not this one. The agent sends logs out; nothing needs to come in.

Learn it: EC2 (Elastic Compute Cloud) · CloudWatch Logs

Question 16An EC2 instance in a public subnet sends its log lines to CloudWatch Logs. Which way do they travel?

Out through the internet gateway to CloudWatch Logs' public AWS endpoint.Correct. Like SQS and DynamoDB, CloudWatch Logs is a public AWS service, not something inside the VPC.They stay inside the VPC; CloudWatch Logs runs in every subnet.Not this one. It runs outside every customer VPC.Through the RDS database.Not this one. Logs don't pass through databases.Through an SQS queue.Not this one. The agent sends straight to CloudWatch Logs.

Learn it: VPC (Virtual Private Cloud) · CloudWatch Logs

Question 17What does "EC2 (Elastic Compute Cloud)" mean?

Rent a virtual server by the second.Correct. Think of it as: Renting a computer you have to look after yourself.Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.

Learn it: EC2 (Elastic Compute Cloud)

Question 18Which term is this? "Rent a virtual server by the second."

EC2 (Elastic Compute Cloud)Correct. Yes. Think of it as: Renting a computer you have to look after yourself.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.

Learn it: EC2 (Elastic Compute Cloud)

Question 19Which AWS term is described by this analogy? "Renting a computer you have to look after yourself."

EC2 (Elastic Compute Cloud)Correct. Yes: Rent a virtual server by the second.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.

Learn it: EC2 (Elastic Compute Cloud)

EC2

Worth another look

Your weak spots

Services

Concepts