1. DDoS attacks that happen at the application layer commonly target web applications with lower volumes of traffic compared to infrastructure attacks. To mitigate these types of attacks, you should probably want to include a WAF (Web Application Firewall) as part of your infrastructure. To inspect all HTTP requests, WAFs sit in-line with your application traffic. Unfortunately, this creates a scenario where WAFs can become a point of failure or bottleneck. To mitigate this problem, you need the ability to run multiple WAFs on demand during traffic spikes. This type of scaling for WAF is done via a 'WAF sandwich. Which of the following statements best describes what a 'WAF sandwich' is? Choose the correct answer from the options below

A) The EC2 instance running your WAF software is placed between your private subnets and any NATed connections to the Internet.
B) The EC2 instance running your WAF software is placed between your public subnets and your Internet Gateway.
C) The EC2 instance running your WAF software is placed between your public subnets and your private subnets.
D) The EC2 instance running your WAF software is included in an Auto Scaling group and placed in between two Elastic load balancers.



2. An employee keeps terminating EC2 instances on the production environment. You've determined the best way to ensure this doesn't happen is to add an extra layer of defence against terminating the instances. What is the best method to ensure the employee does not terminate the production instances? Choose the 2 correct answers from the options below(Select 2answers)

A) Modify the IAM policy on the user to require MFA before deleting EC2 instances
B) Modify the IAM policy on the user to require MFA before deleting EC2 instances and disable MFA access to the employee
C) Tag the instance with a production-identifying tag and add resource-level permissions to the employee user with an explicit deny on the terminate API call to instances with the production tag.
D) Tag the instance with a production-identifying tag and modify the employees group to allow only start, stop, and reboot API calls and not the terminate instance call.



3. Which of the following is the correct sequence of how KMS manages the keys when used along with the Redshift cluster service

A) The master keys encrypts the cluster key, database key and data encryption keys
B) The master keys encrypts the database key. The database key encrypts the data encryption keys.
C) The master keys encrypts the data encryption keys. The data encryption keys encrypts the database key
D) The master keys encrypts the cluster key. The cluster key encrypts the database key. The database key encrypts the data encryption keys.



4. You company has mandated that all data in AWS(Amazon Web Service) be encrypted at rest. How can you achieve this for EBS volumes? Choose 2 answers from the options given below(Select 2answers)

A) Use Windows Bitlocker for windows-based instances
B) Use AWS(Amazon Web Service) KMS to encrypt the existing EBS volumes
C) Use TreuEncrypt for Linux based instances
D) Enable encryption on existing EBS volumes



5. Your application currently use AWS(Amazon Web Service) Cognito for authenticating users. Your application consists of different types of users. Some users are only allowed read access to the application and others are given contributor access. How would you manage the access effectively?

A) Create different cognito groups, one for the readers and the other for the contributors.
B) Create different cognito endpoints , one for the readers and the other for the contributors.
C) This needs to be managed via Web security tokens
D) You need to manage this within the application itself