Correct option:

Use account-to-account sharing

To make your AWS Service Catalog products available to users who are not in your AWS account, such as users who belong to other organizations or other AWS accounts in your organization, you share your portfolios with them. You can share in several ways, including account-to-account sharing, organizational sharing, and deploying catalogs using stack sets.

When you share a portfolio using account-to-account sharing or AWS Organizations, you allow an AWS Service Catalog administrator of another AWS account to import your portfolio into his or her account and distribute the products to end-users in that account.

This imported portfolio isn't an independent copy. The products and constraints in the imported portfolio stay in sync with changes that you make to the shared portfolio, the original portfolio that you shared. The recipient administrator, the administrator with whom you share a portfolio, cannot change the products or constraints but can add AWS Identity and Access Management (IAM) access for end-users.

When you add products or constraints to the shared portfolio or remove products or constraints from it, the change propagates to all imported instances of the portfolio. For example, if you remove a product from the shared portfolio, that product is also removed from the imported portfolio. It is also removed from all local portfolios that the imported product was added. If an end-user launched a product before you removed it, the end user's provisioned product continues to run, but the product becomes unavailable for future launches.

Incorrect options:

Deploy a copy of the catalog into each of the recipient AWS accounts - When a copy of the catalog is created, it is not a reference to the original portfolio. Any changes made after the copy are not propagated to the copied version. Hence, this is not the right answer.

Use stack sets to deploy your catalog to another AWS account - You can use stack sets to deploy your catalog to many accounts at the same time. If you want to share a reference (an imported version of your portfolio that stays in sync with the original), you can use account-to-account sharing or you can share using AWS Organizations.

Catalogs cannot be shared but can be re-deployed or re-created in a different AWS account - This is incorrect. As discussed above, catalogs can be shared between different AWS accounts.

Reference:

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing.html

Correct option:

Alias

Amazon Route 53 alias records provide a Route 53–specific extension to DNS functionality. Alias records let you route traffic to selected AWS resources, such as CloudFront distributions and Amazon S3 buckets. They also let you route traffic from one record in a hosted zone to another record.

Unlike a CNAME record, you can create an alias record at the top node of a DNS namespace, also known as the zone apex. For example, if you register the DNS name example.com, the zone apex is example.com. You can't create a CNAME record for example.com, but you can create an alias record for example.com that routes traffic to www.example.com.

Incorrect options:

CNAME - A CNAME record maps DNS queries for the name of the current record, such as acme.example.com, to another domain (example.com or example.net) or subdomain (acme.example.com or zenith.example.org). You cannot use a CNAME record for root domains, so this option is ruled out.

A - You use an A record to route traffic to a resource, such as a web server, using an IPv4 address in dotted-decimal notation.

AAAA - You use an AAAA record to route traffic to a resource, such as a web server, using an IPv6 address in colon-separated hexadecimal format.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html

Correct option:

Add a rule to the Network ACLs to allow outbound traffic on ports 1024 - 65535

A Network Access Control List (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.

When you create a custom Network ACL and associate it with a subnet, by default, this custom Network ACL denies all inbound and outbound traffic until you add rules. A network ACL has separate inbound and outbound rules, and each rule can either allow or deny traffic. Network ACLs are stateless, which means that responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).

The client that initiates the request chooses the ephemeral port range. The range varies depending on the client's operating system. Requests originating from Elastic Load Balancing use ports 1024-65535. List of ephemeral port ranges:

1.Many Linux kernels (including the Amazon Linux kernel) use ports 32768-61000.

2.Requests originating from Elastic Load Balancing use ports 1024-65535.

3.Windows operating systems through Windows Server 2003 use ports 1025-5000.

4.Windows Server 2008 and later versions use ports 49152-65535.

5.A NAT gateway uses ports 1024-65535.

AWS Lambda functions use ports 1024-65535.

Incorrect options:

Add a rule to the Network ACLs to allow outbound traffic on ports 1025 - 5000 - As discussed above, Windows operating systems through Windows Server 2003 use ports 1025-5000. ELB uses the port range 1024-65535.

Add a rule to the Network ACLs to allow outbound traffic on ports 32768 - 61000 - As discussed above, Linux kernels (including the Amazon Linux kernel) use ports 1025-5000. ELB uses the port range 1024-65535.

Add a rule to the Security Group allowing outbound traffic on port 80 - A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. Security groups act at the instance level, not the subnet level. Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

Correct option:

AuroraReplicaLagMaximum - This metric captures the maximum amount of lag between the primary instance and each Aurora DB instance in the DB cluster.

Incorrect options:

AuroraBinlogReplicaLag - This metric captures the amount of time a replica DB cluster running on Aurora MySQL-Compatible Edition lags behind the source DB cluster.

This metric reports the value of the Seconds_Behind_Master field of the MySQL SHOW SLAVE STATUS command. This metric is useful for monitoring replica lag between Aurora DB clusters that are replicating across different AWS Regions.

AuroraReplicaLag - This metric captures the amount of lag an Aurora replica experiences when replicating updates from the primary instance.

InsertLatency - This metric captures the average duration of insert operations.

Reference:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.AuroraMySQL.Monitoring.Metrics.html

Correct option:

S3 Server Side encryption

Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customer’s operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.

Controls that apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives are called shared controls. In shared control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services. Configuration Management forms a part of shared controls - AWS maintains the configuration of its infrastructure devices, but a customer is responsible for configuring their own guest operating systems, databases, and applications.

For the given use-case, AWS is responsible for managing the S3 server-side encryption.

Shared Responsibility Model Overview: 

https://aws.amazon.com/compliance/shared-responsibility-model/

Incorrect options:

S3 bucket policies

S3 versioning

S3 ACLs

These three options are the responsibilities of the customer.

Reference:

https://aws.amazon.com/compliance/shared-responsibility-model/

Correct option:

Use AWS CloudFormation templates for managing and maintaining the network infrastructure

AWS CloudFormation gives you an easy way to model a collection of related AWS and third-party resources, provision them quickly and consistently, and manage them throughout their lifecycles, by treating infrastructure as code. A CloudFormation template describes your desired resources and their dependencies so you can launch and configure them together as a stack. You can use a template to create, update, and delete an entire stack as a single unit, as often as you need to, instead of managing resources individually. You can manage and provision stacks across multiple AWS accounts and AWS Regions.

You can manage resource scaling by sharing CloudFormation templates to be used across your organization, to meet safety, compliance, and configuration standards across all AWS accounts and regions. Templates and parameters enable easy scaling so you can share best practices and company policies. Additionally, CloudFormation StackSets enables you to create, update, or delete stacks across multiple AWS accounts and Regions, with a single operation.

To further automate resource management across your organization, you can integrate CloudFormation with other AWS services, including AWS Identity and Access Management (IAM) for access control, AWS Config for compliance, and AWS Service Catalog for turnkey application distribution and additional governance controls. Integrations with CodePipeline and other builder tools let you implement the latest DevOps best practices and improve automation, testing, and controls.

Incorrect options:

Use AWS Elastic Beanstalk for managing and maintaining the network resource - AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS. You can simply upload your code and Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, auto-scaling to application health monitoring. At the same time, you retain full control over the AWS resources powering your application and can access the underlying resources at any time.

Elastic Beanstalk is a PaaS-like layer on top of AWS's IaaS services which abstracts away the underlying EC2 instances, Elastic Load Balancers, auto-scaling groups, etc. This makes it a lot easier for developers, who don't want to be dealing with all the systems stuff, to get their application quickly deployed on AWS.

CloudFormation, on the other hand, doesn't automatically do anything. It's simply a way to define all the resources needed for deployment in a huge JSON/YAML file. So a CloudFormation template might create two Elastic Beanstalk environments (production and staging), a couple of ElasticCache clusters, a DynamoDB table, and then the proper DNS in Route53.

Use AWS Config for managing and maintaining the network infrastructure - AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.

AWS Config records details of changes to your AWS resources to provide you with a configuration history. You can use the AWS Management Console, API, or CLI to obtain details of what a resource’s configuration looked like at any point in the past. AWS Config will also automatically deliver a configuration history file to the Amazon S3 bucket you specify.

Use AWS Service Catalog for managing and maintaining the network infrastructure - AWS Service Catalog was developed for organizations, IT teams, and managed service providers (MSPs) that need to centralize policies. It allows IT, administrators, to vend and manage AWS resources and services. For large organizations, it provides a standard method of provisioning cloud resources for thousands of users. It is also suitable for small teams, where front-line development managers can provide and maintain a standard dev/test environment.

Administrators use AWS Service Catalog to create catalogs of products by importing AWS CloudFormation templates. An end-user with access to a portfolio can use the AWS Management Console to find a standard dev/test environment product, for example, in the form of an AWS CloudFormation template, then manage the resulting resources using the AWS CloudFormation console. The products in Service Catalog are CloudFormation templates. Service Catalog can only allow product creation from within the catalog whereas CloudFormation is more seamless for automating infrastructure.

References:

https://aws.amazon.com/cloudformation/

https://stackoverflow.com/questions/14422151/what-is-the-difference-between-elastic-beanstalk-and-cloudformation-for-a-net-p

https://aws.amazon.com/servicecatalog/faqs/

Correct option:

AWS CloudFormation will not delete this bucket when it deletes the stack

This template creates a bucket as a website

When run from AWS CLI, URL of the website hosted on S3 will be displayed as output

The template above creates a bucket as a website. The AccessControl property is set to the canned ACL PublicRead (public read permissions are required for buckets set up for website hosting). Because this bucket resource has a DeletionPolicy attribute set to Retain, AWS CloudFormation will not delete this bucket when it deletes the stack. The Output section uses Fn::GetAtt to retrieve the WebsiteURL attribute and DomainName attribute of the S3Bucket resource.

Incorrect options:

AWS CloudFormation will delete this bucket when it deletes the stack

The output section takes the website URL and bucket URL for another stack, that is part of the nested stack configuration

The S3 bucket created is configured to store objects from the PublicRead API of Amazon RDS

These three options contradict the explanation above, so these options are incorrect.

Reference:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-s3.html

Correct option:

Amazon RDS databases, Amazon Redshift clusters

To help keep your secrets secure, Secrets Manager can automatically rotate them on a schedule. When it rotates a secret, Secrets Manager updates the credentials in both the secret and the database or service so that you don't have to manually change the credentials. Secrets Manager uses a Lambda rotation function to communicate with both Secrets Manager and the database or service.

AWS Secrets Manager has built-in rotation support for secrets for the following:

1.Amazon RDS databases

2.Amazon DocumentDB databases

3.Amazon Redshift clusters

https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

Incorrect options:

Amazon EMR, Amazon Redshift clusters - Amazon EMR is a managed cluster platform that simplifies running big data frameworks, such as Apache Hadoop and Apache Spark, on AWS to process and analyze vast amounts of data. Amazon EMR is integrated with Secrets Manager. You can store your private Git-based registry credentials using Secrets Manager.

AWS CloudFormation, Amazon RDS databases - AWS CloudFormation is integrated with Secrets Manager. You can use AWS CloudFormation to create and reference secrets from within your AWS CloudFormation stack template. You can create a secret and then reference it from another part of the template.

Amazon Elastic Container Service (Amazon ECS), Amazon DocumentDB databases - Amazon ECS enables you to inject sensitive data into your containers by storing your sensitive data in Secrets Manager secrets and then referencing them in your container definition. Sensitive data stored in Secrets Manager secrets can be exposed to a container as environment variables or as part of the log configuration.

EMR, CloudFormation, and ECS are not supported for built-in rotation of secrets by the Secrets Manager, so these three options are incorrect.

References:

https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-built-in.html

https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating.html

Correct option:

Amazon FSx Windows File Server - For Windows-based applications, Amazon FSx provides fully managed Windows file servers with features and performance optimized for "lift-and-shift" business-critical application workloads including home directories (user shares), media workflows, and ERP applications. It is accessible from Windows and Linux instances via the SMB protocol.

Many Windows-based business-critical applications and workloads, such as ERP, CRM, and custom applications, require shared file storage provided by Windows-based file systems (NTFS) and use the SMB protocol. Amazon FSx is built on Windows Server and provides you with the compatible Windows features and performance that your applications require from a file system. By providing fully managed Windows file storage with features like Microsoft Active Directory (Microsoft AD) integration and automatic backups, you can easily migrate your file-based applications to AWS.

Incorrect options:

Amazon FSx for Lustre - For compute-intensive and fast processing workloads, like high-performance computing (HPC), machine learning, EDA, and media processing, Amazon FSx for Lustre, provides a file system that’s optimized for performance, with input and output stored on Amazon S3. FSx for Lustre is designed for Linux workloads.

Amazon Elastic File System (EFS) - Amazon EFS is a file storage service for use with Amazon compute (EC2, containers, serverless) and on-premises servers. Amazon EFS provides a file system interface, file system access semantics (such as strong consistency and file locking), and concurrently-accessible storage for up to thousands of Amazon EC2 instances. Amazon EFS is not supported on Windows instances.

AWS Storage Gateway - AWS Storage Gateway is a set of hybrid cloud services that give you on-premises access to virtually unlimited cloud storage. Customers use Storage Gateway to integrate AWS Cloud storage with existing on-site workloads so they can simplify storage management and reduce costs for key hybrid cloud storage use cases. These include moving backups to the cloud, using on-premises file shares backed by cloud storage, and providing low latency access to data in AWS for on-premises applications. AWS Storage Gateway is not a storage service itself, it stores data on Amazon S3 storage service.

Reference:

https://aws.amazon.com/fsx/windows/

Correct option:

You must give the S3 bucket the same name as the record that you want to use to route traffic to the bucket

When you configure an Amazon S3 bucket for website hosting, you must give the bucket the same name as the record that you want to use to route traffic to the bucket. For example, to route traffic for "example.com" to an Amazon S3 bucket that's configured for website hosting, the bucket name must be "example.com".

Incorrect options:

Amazon S3 website endpoints need an SSL certificate for supporting HTTPS requests. Check the certificate expiry and validation - Amazon S3 website endpoints don't support HTTPS.

Confirm that the HOSTNAME record for the domain is pointing to the correct website endpoint - The alias or CNAME (not HOSTNAME) record for the domain should be pointing to the correct website endpoint.

The domain should resolve to the same IP address every time, check if this works - The DNS query must be directed to the correct set of name servers to answer the DNS query. The Resolving IP address will not be static.

Reference:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/troubleshooting-s3-bucket-website-hosting.html