Task 4.1: Apply Authentication Mechanisms DEA-C01 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A data engineer is configuring an IAM role for an AWS service (such as EC2) to access another AWS service through a VPC endpoint. What is the primary purpose of the IAM role in this context?

   • ATo grant the service permission to access the other service, subject to the VPC endpoint policy.
   • BTo authenticate the VPC endpoint itself to the AWS service.
   • CTo replace the need for a VPC endpoint policy.
   • DTo provide a static IP address for the service when accessing the other service.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A data engineer is choosing between Amazon RDS and running a database on an EC2 instance. What is a key difference between these two options?

   • AAmazon RDS requires the engineer to manage the database software, while EC2 does not.
   • BAmazon RDS is unmanaged, so the engineer has full control over the operating system, while EC2 is managed.
   • CBoth RDS and EC2 provide the same level of operational responsibility.
   • DAmazon RDS is a managed service, so AWS handles patching and backups, while EC2 requires the engineer to manage these tasks.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In SageMaker Unified Studio, what is the purpose of a domain unit?

   • AIt is a grouping of users and resources that defines a boundary for access control.
   • BIt is a storage location for datasets.
   • CIt is a type of IAM role used to access SageMaker.
   • DIt is a compute resource used to run training jobs.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company runs a data processing application on Amazon EC2 instances in a private subnet. The application needs to access an Amazon S3 bucket that contains sensitive data. The company wants to ensure that traffic to S3 never traverses the public internet and that access is restricted to only the EC2 instances in the VPC. Which configuration should be used?

   • ACreate a VPC endpoint for S3, attach a bucket policy that allows access only from the VPC endpoint, and configure the EC2 instances' security group to allow outbound traffic to the endpoint.
   • BCreate a NAT gateway in a public subnet and route the EC2 instances' traffic through it to reach S3 over the internet.
   • CUse an S3 Access Point with a policy that allows access only from the EC2 instances' private IP addresses.
   • DAttach an IAM role to the EC2 instances that grants S3 access and rely on the security group to block public access.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A data engineer needs to allow an EC2 instance to read from an S3 bucket without storing long-term AWS credentials on the instance. Which IAM feature should be used?

   • ACreate an IAM user with S3 read access and store the access key and secret key on the instance.
   • BCreate an IAM role with a policy that allows S3 read access, and attach the role to the EC2 instance.
   • CCreate an IAM group with S3 read access and add the EC2 instance to the group.
   • DCreate an S3 bucket policy that grants public read access to the bucket.
   Reveal Solution Discussion Select an answer first