Question 1 Todo.io creates a bucket named todoio-pictures in eu-west-1. Which statement is true?
Choose one answer No one else in any AWS account can use that name, and the bucket's data lives in eu-west-1. Correct. Bucket names are globally unique, but every bucket lives in one Region. The name only has to be unique within Todo.io's account. Not this one. Names are unique across all of AWS. The bucket exists in every Region. Not this one. It lives in the Region you created it in. The name only has to be unique within eu-west-1. Not this one. Names are unique across every Region.
Learn it: S3 (Simple Storage Service)
Question 2 What kind of storage is Amazon S3?
Choose one answer Learn it: S3 (Simple Storage Service)
Question 3 Is Amazon S3 inside Todo.io's VPC?
Choose one answer No. S3 is a public AWS service; traffic reaches it through the internet gateway, a NAT gateway or a gateway endpoint. Correct. Like DynamoDB and SQS, S3 sits outside every customer VPC. Yes. Each subnet has its own copy of every bucket. Not this one. Buckets live in a Region, not in subnets. Only in private subnets. Not this one. S3 isn't in any of your subnets. Only Lambda can reach S3. Not this one. Anything with permission and a network path can.
Learn it: VPC (Virtual Private Cloud) · S3
Question 4 Todo.io creates a new S3 bucket and changes no settings. Can someone on the internet read its objects?
Choose one answer No. New buckets are private, with Block Public Access turned on. Correct. Making anything public takes deliberate steps, which Level 1 covers. Yes, anyone with the URL. Not this one. Nothing in a new bucket is public. They can list the objects but not read them. Not this one. They can do neither. Only from us-east-1. Not this one. Where the reader is doesn't matter; the bucket is private.
Learn it: S3 (Simple Storage Service)
Question 5 Todo.io's pictures grow by about 1 TB a month. What must Todo.io do about S3 capacity?
Choose one answer Nothing. S3 grows as you add objects, and you pay for what you store. Correct. There is no size to choose and no disk to fill. Choose a bucket size and enlarge it each month. Not this one. Buckets have no size setting. Create a new bucket for every terabyte. Not this one. One bucket can hold any amount of data. Ask AWS for more capacity each month. Not this one. Storage isn't something you request.
Learn it: S3 (Simple Storage Service)
Question 6 In S3, what is an object's key?
Choose one answer Its full name inside the bucket, such as pictures/u-123/avatar.png. Correct. Bucket plus key identifies one object. The slashes are just part of the name. The encryption key that protects it. Not this one. Encryption keys are a separate topic (Level 1). The access key used to upload it. Not this one. Access keys are credentials, not object names. The Region the object is stored in. Not this one. The Region belongs to the bucket.
Learn it: S3 (Simple Storage Service)
Question 7 Todo.io's auditors ask who downloaded a file from an S3 bucket last week. CloudTrail is on with its default settings. Will it have that?
Choose one answer No. Object reads are data events, which CloudTrail doesn't log by default. They have to be turned on. Correct. By default CloudTrail logs management events, such as creating a bucket, not every object read. Yes. CloudTrail logs every object read by default. Not this one. Only management events are logged by default. Yes, in CloudWatch Logs. Not this one. CloudWatch Logs holds what applications print, not who read an object. No. S3 object reads can never be recorded. Not this one. They can, once CloudTrail data events are turned on.
Learn it: CloudTrail
Question 8 A teammate asks what controls who can read objects in an S3 bucket. Which answer is right?
Choose one answer IAM policies on the caller, and the bucket policy on the bucket itself (a resource-based policy). Correct. The bucket policy names who may use the bucket. Block Public Access can override any rule that would make it public. A security group on the bucket. Not this one. Buckets have no security groups. The subnet the bucket is in. Not this one. Buckets aren't in subnets. IAM Identity Center. Not this one. Identity Center gives people roles in accounts; it doesn't set bucket permissions.
Learn it: S3 (Simple Storage Service) · IAM policy
Question 9 Which of Todo.io's data belongs in S3?
Choose one answer Profile pictures and other uploaded files. Correct. Whole files read and written as one piece are what object storage is for. Todo rows that reports join with users and tags. Not this one. Related rows and joins belong in a relational database such as RDS. Jobs waiting for a worker. Not this one. Work waiting to be done belongs in a queue such as SQS. Login sessions looked up by id thousands of times a second. Not this one. Fast lookups by key belong in DynamoDB.
Learn it: S3 (Simple Storage Service)
Question 10 What is the ARN of an S3 bucket named todoio-pictures?
Choose one answer arn:aws:s3:::todoio-picturesCorrect. Bucket names are globally unique, so S3 bucket ARNs leave out the Region and the account ID. arn:aws:s3:eu-west-1:111122223333:todoio-picturesNot this one. Most ARNs have a Region and account; S3 bucket ARNs don't. s3://todoio-picturesNot this one. That is the address the CLI uses, not an ARN. arn:aws:s3:::bucket/todoio-picturesNot this one. There is no bucket/ prefix.
Learn it: ARN (Amazon Resource Name) · S3
Question 11 Todo.io must keep a record of every AWS API call for seven years. What does it need?
Choose one answer A CloudTrail trail that delivers events to an S3 bucket, kept for seven years. Correct. A trail saves events to S3 for as long as you choose. Event history alone stops at 90 days. Set Event history to keep seven years. Not this one. Event history is fixed at 90 days. CloudWatch metrics. Not this one. Metrics are numbers over time, not a record of API calls. AWS Config. Not this one. Config records how resources are set up, not every API call.
Learn it: CloudTrail
Question 12 What does "S3 (Simple Storage Service)" mean?
Choose one answer Learn it: S3 (Simple Storage Service)
Question 13 Which term is this? "Unlimited storage for files ("objects") in containers called buckets."
Choose one answer Learn it: S3 (Simple Storage Service)
Question 14 Which AWS term is described by this analogy? "A warehouse of labelled boxes you can reach from anywhere."
Choose one answer Learn it: S3 (Simple Storage Service)