EC2 (Elastic Compute Cloud) quiz · Level 0

Question 1The Todo.io app runs on an EC2 instance and must write to a DynamoDB table. What is the most secure way to give it AWS credentials?

Attach an IAM role to the instance through an instance profile.Correct. The SDK fetches temporary credentials for the role from the instance itself, and they rotate automatically. There are no long-lived keys to leak.Create an IAM user's access keys and put them in the app's config file.Not this one. Long-lived keys in a file get copied, committed to Git and forgotten. Anyone who finds them has the access.Pass access keys to the instance in its user data.Not this one. User data is readable by anything on the instance and isn't secret. It's no safer than a config file.Use the root user's access keys, because they never expire.Not this one. Never expiring is the problem. Root keys should not exist at all.

Learn it: EC2 (Elastic Compute Cloud) · Temporary credentials · IAM role · Design Todo.io on EC2

Question 2Todo.io runs its app on EC2. A security patch for the operating system is released. Whose job is it to install it?

Todo.io's. On EC2, everything from the operating system up is the customer's job.Correct. This is the shared responsibility model: AWS runs the hardware and the hypervisor, you run what is on the instance.AWS's, automatically, for every instance.Not this one. AWS doesn't touch the operating system on your instances.Nobody's. EC2 instances never need patching.Not this one. They need patching like any server.Only the root user's, from the console.Not this one. Patching happens on the instance, by whoever runs it, not through the root user.

Learn it: EC2 (Elastic Compute Cloud)

Question 3Todo.io wants every new app server to start with the same operating system and the same software already installed. What should every launch use?

The same AMI (Amazon Machine Image).Correct. The AMI is the starting disk image: operating system plus whatever you baked in.The same instance type.Not this one. The instance type sets size (CPU and memory), not what is installed.The same security group.Not this one. That decides who can connect, not what runs.The same network interface.Not this one. Each instance gets its own; it carries addresses, not software.

Learn it: EC2 (Elastic Compute Cloud)

Question 4Todo.io's app server keeps running out of memory. What should Todo.io change?

The instance type, to one with more memory.Correct. The instance type sets how much CPU and memory the server has.The AMI.Not this one. The AMI decides the software, not the hardware.The subnet.Not this one. Moving subnets changes the network, not the server's size.The security group.Not this one. Security groups only filter traffic.

Learn it: EC2 (Elastic Compute Cloud)

Question 5A Linux test server runs for about 40 minutes a day and is stopped the rest of the time. How is it billed as an On-Demand instance?

Per second while it runs, with a one-minute minimum each time it starts.Correct. You rent EC2 by the second, so a stopped instance costs nothing for compute (its disk is still billed).A fixed monthly price, running or not.Not this one. That is closer to a Reserved Instance commitment, not On-Demand.Per hour, rounded up, for all instances.Not this one. Linux On-Demand instances are billed per second.Only while its CPU is busy.Not this one. You pay while it runs, busy or idle.

Learn it: EC2 (Elastic Compute Cloud)

Question 6Which of Todo.io's compute choices still leaves Todo.io patching an operating system?

Amazon EC2.Correct. With EC2 you get a server, and the operating system on it is yours to maintain.AWS Lambda.Not this one. Lambda has no server for you to manage.Amazon ECS on Fargate.Not this one. With Fargate, AWS runs and patches the servers under your containers.Amazon API Gateway.Not this one. It is a managed front door with nothing to patch.

Learn it: EC2 (Elastic Compute Cloud) · ECS and Fargate · Lambda

Question 7Todo.io's app on EC2 writes log files, but nothing shows up in CloudWatch Logs. What is needed?

Install the CloudWatch agent on the instance, and allow the instance's role to write logs.Correct. EC2 doesn't send logs by itself. Lambda and Fargate do, but an instance is your server.Nothing; EC2 sends every file automatically.Not this one. It sends nothing until the agent is set up.Turn on CloudTrail.Not this one. CloudTrail records API calls, not files on an instance.Open an inbound port on the instance.Not this one. The agent sends logs out; nothing needs to come in.

Learn it: EC2 (Elastic Compute Cloud) · CloudWatch Logs

Question 8What does "EC2 (Elastic Compute Cloud)" mean?

Rent a virtual server by the second.Correct. Think of it as: Renting a computer you have to look after yourself.Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.

Learn it: EC2 (Elastic Compute Cloud)

Question 9Which term is this? "Rent a virtual server by the second."

EC2 (Elastic Compute Cloud)Correct. Yes. Think of it as: Renting a computer you have to look after yourself.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.

Learn it: EC2 (Elastic Compute Cloud)

Question 10Which AWS term is described by this analogy? "Renting a computer you have to look after yourself."

EC2 (Elastic Compute Cloud)Correct. Yes: Rent a virtual server by the second.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.

Learn it: EC2 (Elastic Compute Cloud)

EC2 (Elastic Compute Cloud)

Worth another look

Your weak spots

Services

Concepts