Quiz BDS-C00: Amazon AWS Certified Big Data - Specialty

The correct answer is B. Modify the Network ACLs associated with all public subnets in the VPC to deny access from the IP address block.
The goal is to quickly and temporarily block traffic from a specific IP address block across a VPC for 24 hours. The best fit for this is a Network ACL, because:
- Network ACLs are stateless and operate at the subnet level.
- They can explicitly deny traffic from specific IP ranges.
- They are evaluated for all traffic entering and leaving the subnet.
- They can be changed quickly and later reverted when the temporary block is no longer needed.
Why B is best:
- If the offending IP block is attacking multiple applications in the VPC, placing a deny rule in the Network ACLs for the relevant public subnets can stop the traffic before it reaches the instances.
- This is a fast, centralized way to apply the block.
- Since the request is temporary, Network ACLs are well suited because the rule can be removed after 24 hours.
Why the other options are not as good:
A. Create an AD policy to modify Windows Firewall settings on all hosts in the VPC
- This only applies to Windows hosts.
- It is more complex and slower to deploy across all systems.
- It is not a good universal solution for all applications in the VPC.
C. Add a rule to all of the VPC Security Groups to deny access from the IP address block
- Security groups do not support explicit deny rules.
- They are stateful and only allow traffic; they cannot block traffic with a deny entry.
- Therefore, this is not possible as stated.
D. Modify the Windows Firewall settings on all Amazon Machine Images (AMIs) that your organization uses in that VPC
- This would only affect new instances launched from those AMIs, not existing instances.
- It is also slower and more operationally cumbersome than modifying the subnet-level controls.
- It is not the quickest way to stop the attack immediately.
Key concept:
- Security Groups: stateful, allow-only, instance-level.
- Network ACLs: stateless, allow and deny, subnet-level.
Because the requirement is to quickly and temporarily deny access from an IP block, Network ACLs are the best choice.

The correct answers are A and C.
Why A is correct:
AWS CloudWatch Logs is the standard AWS service for centrally collecting and viewing logs from multiple sources, including both operating system logs and application logs.
Option A describes a valid approach:
- Use AWS CloudFormation to create a CloudWatch Logs log group.
- Install and configure the CloudWatch Logs agent on the instance.
- Send both OS and application logs into CloudWatch Logs.
This gives the operations and development teams a single place to inspect logs.
Why C is correct:
Option C describes another centralized logging pattern:
- Use configuration management to set up remote logging.
- Send log events to Amazon Kinesis.
- Store or analyze them in services such as Amazon Redshift or Amazon CloudSearch.
This is also a valid way to centralize logs from both operating system and application layers into a single searchable/analytical pipeline.
Why the other options are incorrect:
B is incorrect:
- CloudTrail is used for auditing AWS API activity, not for collecting OS/application logs.
- Sending events via UDP packets to CloudTrail does not fit how CloudTrail works.
D is incorrect:
- The CloudWatch Logs agent does not automatically send all operating system logs.
- You must configure which logs to collect.
- It also ignores the application side by saying only application logs need configuration, which is misleading.
E is incorrect:
- Merging logs and using IAM to let teams view EC2 console output is not a proper centralized logging solution.
- EC2 console output is not a substitute for full OS and application log collection.
Summary:
- A is correct because CloudWatch Logs can centrally collect both OS and application logs.
- C is correct because Kinesis-based log streaming can also centralize and analyze logs from both sources.
Answer: A and C

The correct answer is D. AWS Import/Export.
The customer has 10 TB of archival data and only a 1 Mbps Internet connection. At that speed, uploading 10 TB over the network would take an extremely long time, making any Internet-based transfer impractical. The fastest way to get large amounts of data into Amazon Glacier in this situation is to physically ship storage devices to AWS using AWS Import/Export.
Why D is correct:
- AWS Import/Export is designed for large offline data transfers.
- You copy the data to a supported storage device, ship it to AWS, and AWS transfers the data into the target AWS storage service.
- This avoids the bottleneck of the slow 1 Mbps connection.
- For very large datasets, physical transfer is much faster than network upload.
Why the other options are not correct:
A. Amazon Glacier multipart upload
- Multipart upload helps with large uploads by splitting data into parts.
- However, it still depends on the Internet connection.
- With a 1 Mbps connection, multipart upload is still far too slow for 10 TB.
B. AWS Storage Gateway
- Storage Gateway is useful for hybrid cloud storage and local caching.
- It still relies on network connectivity to move data to AWS.
- It is not the fastest method for bulk initial transfer over a very slow connection.
C. VM Import/Export
- This service is used to import virtual machine images into AWS.
- It is not intended for general archival data migration to Glacier.
- It does not solve the problem of moving 10 TB quickly over a slow link.
Key point:
When the data volume is very large and network bandwidth is limited, a physical import service is the best choice because it bypasses the internet bottleneck.
Final answer: D. AWS Import/Export

Explanation:
When the application does not experience the expected IOPS or throughput of the PIOPS EBS volume
that was provisioned, the possible root cause could be that the EC2 bandwidth is the limiting factor
and the instance might not be either EBS-optimized or might not have 10 Gigabit network
connectivity. Another possible cause for not experiencing the expected IOPS could also be that the
user is not driving enough I/O to the EBS volumes.
The size of the volume may not affect IOPS.

The correct answer is D.
Why D is correct
The key requirements are:
1. Securely distribute credentials
2. Do it automatically across a large fleet of web servers
3. Support rollback if needed
4. Work at scale for hundreds of instances
Option D says to keep the credential files as a binary blob in an Amazon RDS MySQL DB instance, and have each EC2 instance run a script that pulls the files down from RDS.
This fits the problem best because:
- Centralized storage: The credentials are stored in one place, so updates are consistent.
- Automated retrieval: Each instance can fetch the latest credentials on its own, which scales better than pushing files to hundreds of servers.
- Rollback support: If a bad credential file is deployed, you can restore a previous version in the database and have instances pull it again.
- Integration with configuration management: Since the files are controlled by a configuration management system, storing them centrally and having managed instances retrieve them aligns with automated infrastructure practices.
Why the other options are not as good
A. Store in S3 and have a scheduled pull every 10 minutes
This is closer to a valid solution than some of the others, but it is not the best answer here. It introduces delay because updates only propagate every 10 minutes, and rollback is less cleanly handled in this setup. Also, using S3 for secrets requires careful access control and versioning, and the option does not mention a robust deployment or rollback mechanism.
B. Store in version control and push via CI
This is not secure enough. Putting credentials directly into version control is a bad practice, even if the repository is private. Credentials can be copied, leaked, or accidentally exposed. Also, pushing changes to hundreds of servers from CI is operationally heavier and riskier.
C. Insert into user data and periodically refresh
User data is meant for bootstrapping an instance at launch, not for ongoing secure secret distribution. It is not a good mechanism for frequent credential updates or rollback across a fleet.
D. Keep as a binary blob in RDS and pull from each instance
This is the best match among the given choices because it centralizes the secrets and allows automated retrieval and rollback.
E. Store in version control and copy from local machine
This is insecure and not scalable. It depends on manual action from a local machine and is not suitable for a fleet of hundreds of servers.
Important note
In real-world AWS architectures, the preferred modern approach for distributing database credentials would usually be AWS Secrets Manager or AWS Systems Manager Parameter Store, often with IAM-based access and automatic rotation. But since those are not among the choices, D is the best answer provided.
If you want, I can also explain why an AWS exam might consider D the intended answer even though it is not a best-practice design in modern AWS.

The correct answer is C.
The goal is to provide users in North America and Europe with a similar, low-latency experience by extending the application from us-east-1 to eu-west-1. The best way to do this is to route users to the region that is geographically closest to them.
Why C is correct:
- Amazon Route 53 is AWS’s DNS service.
- A geolocation routing policy lets you route traffic based on the user’s geographic location.
- This means users in Europe can be directed to the Dublin region, while users in the U.S. can be directed to Northern Virginia.
- This improves performance and gives users on both continents an equivalent experience by reducing latency and directing them to the nearest regional deployment.
Why the other options are not correct:
A. Use a public-facing load balancer per region to load-balance web traffic, and enable HTTP health checks
- Load balancers in each region help distribute traffic within that region, but they do not decide which continent’s users should go to which region.
- HTTP health checks only monitor whether an endpoint is healthy; they do not provide geographic traffic routing.
B. Use a public-facing load balancer per region to load-balance web traffic, and enable sticky sessions
- Sticky sessions keep a user bound to the same backend instance after they connect.
- This can be useful for session persistence, but it does not solve global traffic distribution between continents.
D. Use Amazon Route 53, and apply a weighted routing policy to distribute traffic across both regions
- Weighted routing sends traffic based on assigned percentages, such as 50/50 or 70/30.
- It does not route users according to their location.
- A user in Europe might still be sent to Northern Virginia, which would not provide the best equivalent experience.
Important note:
The question says "Route S3," but that is almost certainly a typo. The intended service is Amazon Route 53.
Summary:
- Use Route 53 geolocation routing to send users to the closest regional deployment.
- This is the best choice for providing an equivalent experience across Europe and North America.

The correct answers are B and C.
To make all objects in an Amazon S3 bucket publicly readable, you need a bucket-level configuration that applies to objects stored in the bucket. The two valid ways in the choices are:
B. Configure the bucket ACL to set all objects to public read
A bucket ACL can grant public-read permissions. If configured appropriately, uploaded objects inherit the access defined by the bucket’s permissions model or can be made publicly accessible through ACL settings, depending on how the objects are uploaded and whether object ownership controls are in use.
C. Configure the bucket policy to set all objects to public read
A bucket policy can grant public-read access to all objects in the bucket. This is a common and preferred way to allow public access to static website assets, because you can define a policy that applies to every object in the bucket using the bucket ARN and object ARN pattern.
Why the other options are incorrect:
A. Set permissions on the object to public read during upload
This can make individual objects public, but it does not ensure that all objects uploaded to the bucket are public unless every upload process explicitly sets that permission. The question asks for methods that ensure all objects are set to public read.
D. Use AWS Identity and Access Management roles to set the bucket to public read
IAM roles are used to grant permissions to AWS identities, not to make an S3 bucket publicly readable. Public access is controlled by bucket policies, ACLs, and related S3 public access settings, not by IAM roles for public users.
E. Amazon S3 objects default to public read, so no action is needed
This is false. By default, S3 objects are private. Public access must be explicitly configured.
Important note:
In modern AWS best practice, bucket policies are generally preferred over ACLs for public access control. Also, many AWS environments block public access by default using S3 Block Public Access settings, so you may need to adjust those settings as well if the goal is to make the bucket publicly readable.
So the correct choices are:
B and C

The correct answer is B. Make sure Auto Scaling is configured to launch in both AZs.
Why this is correct
An Elastic Load Balancer can distribute traffic across multiple Availability Zones, but it does not itself decide where new EC2 instances are launched. That responsibility belongs to the Auto Scaling Group.
In this scenario:
- The ELB shows 4 healthy instances in AZ A
- The ELB shows 0 healthy instances in AZ B
- There are no unhealthy instances, so nothing is failing
- The issue is imbalance, not instance health
This means the Auto Scaling Group is likely configured to launch instances only in AZ A, or not configured to use AZ B at all. To balance instances across AZs, the Auto Scaling Group must include both AZ A and AZ B in its subnet or Availability Zone configuration.
Why the other options are wrong
A. Set the ELB to only be attached to another AZ
- This would not solve the problem.
- Removing or changing the ELB attachment does not cause Auto Scaling to distribute instances across AZs.
- The issue is with instance placement, not load balancer attachment.
C. Make sure your AMI is available in both AZs
- AMIs are region-wide, not tied to a specific AZ.
- If an AMI is available in a region, it can be used to launch instances in any AZ within that region.
- This is not the cause of the imbalance.
D. Make sure the maximum size of the Auto Scaling Group is greater than 4
- The maximum size only limits how many instances the Auto Scaling Group can scale out to.
- The problem is not that there are too few maximum instances.
- Also, having a max size greater than 4 would not automatically balance instances across AZs.
Key concept
To achieve multi-AZ balance with EC2 instances behind an ELB:
- The ELB should span multiple AZs
- The Auto Scaling Group must be configured to launch instances into multiple AZs/subnets
So the fix is to update Auto Scaling to include both AZs.

The correct answers are A and C.
Here is why.
What the question is asking
You need a solution that does all of the following:
1. Collect logs from many EC2 web servers in an Auto Scaling group
2. Process the logs hourly to identify unique visitors
3. Store the results in a durable data store for reporting
4. Avoid losing logs when instances are stopped or terminated by a user or Auto Scaling
The key design requirements are:
- Centralized log collection
- Durable storage
- Automated hourly processing/reporting
- Log preservation during instance termination
Why A is correct
A says to:
- Install the Amazon CloudWatch Logs Agent on every web server during bootstrap
- Send logs to CloudWatch Logs
- Use metric filters to create custom metrics
- Run a scheduled task hourly to generate reports based on those metrics
Why this works:
- The CloudWatch Logs Agent can continuously ship logs off the instance, so logs are not lost if the instance dies.
- CloudWatch Logs is a managed, durable service.
- Metric filters can extract information from logs and create metrics.
- A scheduled task can run hourly to process/report on the data.
This satisfies the need to avoid losing logs during termination and to process data regularly.
One note: CloudWatch metric filters are best for extracting numeric values and patterns, not for heavy log analytics. But among the choices given, A is the one that matches the requirements best.
Why C is correct
C says to:
- Run a scheduled task on the web servers that rotates and transmits logs to Amazon S3
- Make sure the shutdown process sends logs when instances stop or terminate
- Use AWS Data Pipeline to move logs from S3 to Amazon Redshift
- Process and generate reports hourly
Why this works:
- S3 is durable storage, so it is a good place to archive logs without losing them.
- Sending logs during shutdown helps preserve logs when Auto Scaling removes instances.
- Redshift is suitable for structured reporting and analysis.
- Data Pipeline can move data between S3 and Redshift on a schedule.
This option clearly meets the requirement to store logs durably and process them for reports.
Why B is incorrect
B sends logs to Amazon Glacier and uses Data Pipeline to process them.
Problems:
- Glacier is meant for archival, not for frequent hourly analysis.
- It is not a practical choice for ongoing reporting workloads that need regular access.
- The workflow is overly slow and cumbersome for hourly processing.
Why D is incorrect
D refers to an "AWS Data Pipeline Logs Agent" and says logs can be moved directly to Redshift.
Problems:
- There is no AWS Data Pipeline Logs Agent used this way.
- Data Pipeline is not an agent installed on EC2 instances for log shipping.
- Metric filters do not directly move web server logs into Redshift.
- The option mixes services in an inaccurate way.
Summary
The two correct approaches are:
- A: Use CloudWatch Logs Agent to ship logs centrally, then use metric filters and scheduled reporting
- C: Ship logs to S3, preserve them during shutdown, then use Data Pipeline to load into Redshift for reporting
So the correct answers are A and C.

The correct answers are A, B, D, and E.
This question is based on the AWS Shared Responsibility Model. In this model, AWS is responsible for security of the cloud, while the customer is responsible for security in the cloud.
Here is why each option is classified the way it is:
A. Life-Cycle management of IAM credentials
Correct. Customers are responsible for creating, managing, rotating, and deleting IAM users, roles, access keys, passwords, and other credentials. AWS provides the IAM service, but the customer controls how those credentials are used and protected.
B. Security Group and ACL settings
Correct. Security groups and network ACLs are customer-configured controls used to manage traffic to and from AWS resources. AWS provides the tools, but the customer is responsible for setting them correctly.
C. Controlling physical access to compute resources
Incorrect. AWS is responsible for the physical security of its data centers, servers, networking hardware, and other infrastructure. Customers do not manage physical access to AWS compute resources.
D. Path management on the EC2 instance’s operating system
Correct. Once you launch an EC2 instance, you are responsible for operating system administration, including patching, updates, and hardening the OS. This includes managing vulnerabilities and patches on the instance.
E. Encryption of EBS volumes
Correct. Customers are responsible for deciding whether to encrypt EBS volumes and for managing encryption settings and keys, depending on the chosen setup. AWS provides the encryption capability, but the customer chooses to use it and configures it appropriately.
F. Decommissioning storage devices
Incorrect. AWS is responsible for securely decommissioning and disposing of its underlying storage hardware in the data center. This falls under AWS’s responsibility for the security of the cloud.
Summary:
Customer responsibilities:
A. IAM credential lifecycle management
B. Security group and ACL configuration
D. EC2 operating system patch management
E. EBS volume encryption
AWS responsibilities:
C. Physical access control
F. Decommissioning storage devices
So the correct answer is A, B, D, E.