ACP-Cloud1 ACP Cloud Computing Certification Questions and Answers

Alibaba Cloud OSS (Object Storage Service) provides extremely high data reliability, typically around 99.99999999%, due to its multi-replica and distributed architecture, ensuring data durability and resilience against single points of failure (SPOF). OSS is designed to store massive amounts of data with high redundancy, making it a preferred choice for businesses that require high reliability and fault tolerance in cloud storage.

SQL injection attacks primarily target databases by exploiting vulnerabilities in web applications. Attackers manipulate SQL queries to gain unauthorized access to the application's backend database, which may lead to data leakage or destruction. Although SQL injection affects the data stored in databases and not directly files or images on the server, the primary target remains the application layer through which the attack is conducted.

In Alibaba Cloud’s VPC architecture, a VRouter (Virtual Router) is used to connect multiple VSwitches within a VPC. The VRouter routes traffic between VSwitches, and each VSwitch in a VPC is associated with a route table managed by the VRouter. This setup enables efficient communication between subnets and applies to the entire VPC.

=================

Elastic Computing on Alibaba Cloud ECS includes features that allow users to quickly start or release multiple instances, upgrade bandwidth without downtime, adjust CPU and memory configurations, and perform horizontal scaling in conjunction with Server Load Balancer (SLB). However, option E is incorrect as there is a limit to the number of disks that can be attached to an ECS instance.

Alibaba Cloud RDS automatically deploys instances in master-slave mode (high availability) without additional configuration or charges. This ensures data redundancy and disaster recovery by maintaining synchronous data replication from the master to the slave instance.

Cloud computing is characterized by large-scale infrastructure, high availability, on-demand service provisioning, and versatility in handling diverse applications and workloads. It supports both multi-tenant and single-tenant configurations, and although containerization is popular, cloud computing is not limited to container-based architectures.

Default and non-default VSwitches do not have the same constraints and operations. Default VSwitches have specific configurations and limitations set by Alibaba Cloud, designed to simplify initial setups. In contrast, non-default VSwitches, created by users, allow for more customized configurations and are typically used in more complex or specialized networking environments. Thus, option C is incorrect as the constraints and operations differ between default and non-default VSwitches.

 You can change the private IP address of an ECS instance after it is created, but you need to stop the instance first. The private IP address must be within the CIDR block of the VPC and the VSwitch that the instance belongs to. You can modify the private IP address of an instance by using the console or the API. References: 3, ACP Cloud Computing Certification - Alibaba Cloud Academy

After stopping an Alibaba Cloud Elastic Compute Service (ECS) instance, you will still be charged for some resources related to that ECS instance, such as disks, snapshots, and public IP addresses, until you release them. The charging policy depends on the billing method and network type of the ECS instance. For pay-as-you-go instances, you can choose whether to enable the No fees for stopped instances feature, which allows you to stop paying for vCPUs and memory when the instance is stopped. However, this feature is only available for VPC-connected instances in some regions1. For subscription instances, you will be charged for the entire subscription period regardless of whether the instance is running or stopped2. References:

1: Billing FAQ - Elastic Compute Service - Alibaba Cloud Documentation Center1

2: Billing overview - Elastic Compute Service - Alibaba Cloud Documentation Center2

Alibaba Cloud Object Storage Service (OSS) is ideal for storing unstructured data, including media files such as pictures, videos, and documents. OSS offers scalable storage, high durability, and easy access, making it well-suited for handling large volumes of unstructured data.

=================

Even with Alibaba Cloud Server Guard enabled, it is still recommended to periodically change passwords and use complex passwords to improve security. Server Guard provides additional protection but is not a substitute for strong password practices.

Data Transmission Service (DTS) is a real-time data streaming service that supports data transmission between data sources such as relational databases, NoSQL, and Big Data (OLAP). DTS supports data migration, data synchronization, and change data subscription scenarios. DTS can migrate your data to and from most of the widely used commercial and open source databases. It supports homogeneous migrations such as MySQL to MySQL, as well as heterogeneous migrations between different database platforms, such as Oracle to MySQL. Migrations can be from on-premises databases to RDS or ECS, databases running on ECS to RDS, or vice versa, as well as from one RDS database to another RDS database. DTS also supports database schema replication between instances, which means that DTS can automatically create the same schema as the source database in the target database. DTS also supports warning when source and destination has some unresolved conflict found, such as data type mismatch, primary key conflict, or foreign key constraint violation. DTS can help you resolve these conflicts by providing suggestions or allowing you to modify the data mapping rules. Therefore, the correct answer is C. Supports all of the above functions. References:

1: Data Transmission Service - Alibaba Cloud

2: What is Data Transmission Service? - Alibaba Cloud

3: Database Migration - AlibabaCloud

4: Cloud Migration without Stopping Services: Alibaba Cloud DTS

With a measurement cycle of 5 minutes and a requirement for five consecutive cycles where disk usage exceeds 80%, it would take 5×5=255 \times 5 = 255×5=25 minutes for CloudMonitor to confirm the condition. After confirmation, CloudMonitor typically processes and sends the alert, which may take an additional 5 minutes, totaling approximately 30 minutes before you receive the alert.

To use Alibaba Cloud CDN, you must add your domain to the "CDN Domain Name List" and then modify the domain’s DNS settings to point to the CNAME provided by Alibaba Cloud. Manual cache refresh (option A) is optional and not a necessary step for initial setup, and while monitoring is useful, it is not required for CDN operation, so option D is also not essential.

The ossbrowser is a graphical tool provided by Alibaba Cloud for uploading and downloading files in OSS, offering an intuitive interface for managing objects. Other tools like ossutil and osscmd are command-line tools, while ossfs is used to mount OSS as a file system on Linux, not a graphical tool.

Alibaba Cloud Security Center is designed to enhance the security of ECS instances by providing proactive monitoring, vulnerability detection, and protection against threats such as brute-force attacks. Security Center includes features such as brute-force attack detection, which will alert you to and help mitigate potential threats to your ECS instance.

=================

An event-triggered task is necessary when creating scaling rules based on specific metrics such as CPU utilization. This allows Auto Scaling to monitor real-time metrics and trigger scaling actions when thresholds are met. Scheduled tasks, by contrast, are based on specific times rather than performance metrics.

According to the Alibaba Cloud Academy, Auto Scaling supports three scaling modes: manual mode, scheduled task, and cloud monitor and event-triggered task. Manual mode requires manual intervention to adjust the number of ECS instances, which is not feasible and with minimum operation efforts. Scheduled task allows you to set the time and number of ECS instances to be added or removed in advance, which is suitable for predictable traffic changes. Cloud monitor and event-triggered task allows you to set the monitoring metrics and thresholds for scaling actions, which is suitable for dynamic traffic changes. Healthy check mode is not a scaling mode, but a feature of SLB to ensure the availability of ECS instances behind the load balancer. References: : ACP Cloud Computing Certification Preparation Course - Auto Scaling, : ACP Cloud Computing Certification Preparation Course - Server Load Balancer

Enabling SELinux on an ECS instance does not interfere with Alibaba Cloud’s ECS monitoring features. SELinux is a security module that enforces mandatory access controls on Linux systems. It operates independently from the monitoring capabilities provided by the ECS console, so ECS metrics and monitoring functions remain unaffected when SELinux is enabled.

Changing directory permissions of the system root directory in Linux can have a significant impact on system functionality and services. Modifying these permissions can lead to restricted access for essential system services, potentially causing service disruptions. Proper care is necessary when altering permissions on critical directories.

When changing the specifications of an RDS instance, service interruptions can occur during some upgrade and downgrade operations, depending on the RDS instance type and the complexity of the change. While upgrades are generally supported, certain modifications may result in brief downtime as the system reconfigures resources. This is contrary to option B. Additionally, database version downgrades are restricted, and MySQL 5.1 can indeed be upgraded directly to MySQL 5.6 in Alibaba Cloud RDS.

Alibaba Cloud provides two main products for Anti-DDoS protection: Anti-DDoS Origin Service, which protects against attacks at the origin server level, and Anti-DDoS Pro Service, which offers advanced DDoS mitigation for applications hosted on Alibaba Cloud. Security Center and Cloud Firewall offer different security functionalities but do not provide direct Anti-DDoS services.

=================

Alibaba Cloud ECS allows users to set an auto-release time for Pay-As-You-Go instances, giving flexibility in handling temporary workloads without manually releasing instances. Notably, the auto-release time can be adjusted multiple times even after the instance has been created, allowing for modifications as business needs change. This feature provides a convenient way to manage costs by automatically releasing instances when they are no longer needed. However, once the auto-release time is set, it must be adjusted or canceled if changes are required.

The maximum number of connections to an RDS instance primarily depends on the memory size of the instance. Higher memory capacity allows for more simultaneous connections, as memory is a key resource in managing and maintaining connections. Alibaba Cloud RDS scales the connection limit based on the instance's memory allocation to ensure stable database performance.

Intelligent DNS resolution is a feature of Alibaba Cloud DNS that allows users to configure different IP addresses for the same domain name based on the geographic locations or ISPs of the visitors. This way, visitors can access the nearest or optimal server for better performance and availability. Intelligent DNS resolution does not support web page content caching, which is a function of Alibaba Cloud CDN. Alibaba Cloud CDN is a distributed network that delivers content from the origin server to the edge nodes closest to the end users, reducing the network latency and bandwidth consumption. Alibaba Cloud CDN caches the static content of the web pages, such as images, CSS, and JavaScript files, on the edge nodes, so that the users can access them faster and reduce the load on the origin server. A user will receive data from the cache in the first-time access, and then will be updated from the origin site in subsequent requests based on the cache expiration time.

References:

1: Intelligent DNS resolution - Alibaba Cloud DNS - Alibaba Cloud Documentation Center

4: Alibaba Cloud Content Delivery Network (CDN) performs content acceleration with the support of intelligent DNS resolution The following function_________is NOT included in intelligent DNS resolution.

5: Alibaba Cloud DNS:Alibaba Cloud line for intelligent DNS resolution (September 16, 2020) - Alibaba Cloud Documentation Center

Alibaba Cloud RDS uses a master-slave or primary-replica architecture to provide high availability. In the event of a master database failure, automatic failover to the standby instance generally occurs within 30 seconds, helping to minimize downtime and maintain service continuity.

=================

Default VPCs do count toward your overall VPC quota in Alibaba Cloud, contrary to option D. Each region has a single default VPC that is automatically created by Alibaba Cloud, and users can create additional VPCs, which are then labeled as non-default VPCs. Default VPCs also have different constraints and operational characteristics compared to user-created VPCs, such as specific configurations for ease of use in basic setups.

When the removal policy is set to “the earliest instance with the scaling configuration,” Auto Scaling will prioritize removing the oldest ECS instances that were created by Auto Scaling. This policy helps manage and rotate instances that may have been running the longest, ensuring newer instances remain available to handle the current load. This approach is beneficial for maintaining cost-effectiveness and operational efficiency.

Alibaba Cloud RDS supports several popular database engines, including MySQL, PostgreSQL, and SQL Server. PPAS (PostgreSQL Plus Advanced Server) is also supported but not Sybase, which is not available as an RDS option on Alibaba Cloud.

In Alibaba Cloud RDS, read-only instances are synchronized from the master instance but do not allow actions such as creating or deleting databases, configuring backup policies, or changing account authorizations. However, you can configure the read-only instance’s whitelist to control access.

 According to the Alibaba Cloud SLB documentation1, SLB provides a health check feature that monitors the availability and performance of the backend servers. If a backend server fails the health check, SLB stops routing requests to it and redirects the traffic to other healthy servers. This way, SLB can improve the system’s availability by eliminating single points of failure (SPOFs). Therefore, option A is a correct statement about SLB.

According to the same documentation1, SLB instances are assigned with public IP addresses or private IP addresses based on the network type. If you delete an SLB instance and create a new one, a new IP address will be allocated to the new instance. You cannot specify or reserve an IP address for an SLB instance. Therefore, option B is also a correct statement about SLB.

Option C is incorrect, because SLB does not require you to install or configure any SLB agent on the backend servers. You only need to add the backend servers to the SLB instance and configure the listener and the server group. SLB will automatically distribute the traffic to the backend servers based on the load balancing algorithm and the health check status2.

Option D is also incorrect, because SLB does not provide a function to automatically synchronize data among backend servers. SLB only handles the network traffic distribution and does not interfere with the data on the backend servers. You need to use other methods or tools to synchronize data among backend servers, such as rsync, lsyncd, or Alibaba Cloud Data Transmission Service (DTS)3.

References: Server Load Balancer:SLB overview, Add backend servers, and Data Transmission Service.

In Alibaba Cloud, resizing the system disk of an ECS instance requires stopping the instance temporarily. This ensures data integrity and successful resizing. Once the system disk is resized, the instance can be restarted to reflect the new disk size.

In Alibaba Cloud VPCs, only custom route tables can be created and deleted by users. The default route table associated with each VPC cannot be deleted, although custom routing entries within it can be modified. This limitation ensures the integrity of essential VPC networking components.

=================

Alibaba Cloud ECS (Elastic Compute Service) is an Infrastructure as a Service (IaaS) offering, providing users with virtualized computing resources like virtual machines. IaaS services offer fundamental cloud infrastructure such as compute, storage, and networking resources.

Different Alibaba Cloud VPCs are completely isolated from each other by default, but they can communicate with each other over the intranet by using different methods, such as Cloud Enterprise Network (CEN), VPN gateways, VPC peering connections, and PrivateLink. These methods allow you to establish secure and reliable connections between VPCs without exposing your network traffic to the internet. References:

Overview of VPC connections - Alibaba Cloud

Cross-VPC peering - Alibaba Cloud

ALIYUN::VPC::VpcPeerConnection - Alibaba Cloud

RDS accounts can be used to connect with the databases created on a given RDS instance. Each account can be bound with multiple databases. However, the read/write permissions of each database can be assigned to multiple RDS accounts, not just one. For example, you can create an account with read-only permission for all databases, and another account with read-write permission for a specific database. This way, you can manage the access control of your databases more flexibly and securely. References:  Introduction to ApsaraDB RDS - Alibaba Cloud Document Center - User Management - Account Permissions

To meet the company’s security requirements, the following solutions should be used together:

A. Enable the VPN on the bastion host (or directly use the VPN image on Alibaba Cloud Marketplace). The administrator uses VPN encrypted communication during O&M. This solution can support secure remote O&M, because VPN (Virtual Private Network) is a technology that creates a secure and encrypted connection over the Internet between the bastion host and the administrator’s device. VPN can protect the data transmitted between the bastion host and the administrator from being intercepted or tampered by malicious third parties1. Alibaba Cloud provides VPN Gateway service that allows users to create VPN connections between VPCs and on-premises data centers, or between VPCs in different regions2. Users can also use VPN images from Alibaba Cloud Marketplace, such as OpenVPN, to create VPN servers on ECS instances3.

B. Build an independent ECS instance as the bastion host or remote logon and O&M, and authorize the bastion host to access ECS instances running other subsystems. This solution can also support secure remote O&M, because a bastion host is a special-purpose ECS instance that acts as a proxy or a gateway for accessing other ECS instances in the VPC. A bastion host can enhance the security of the ECS instances by limiting the exposure of the ECS instances to the public network, and by implementing security policies and monitoring tools on the bastion host4. Alibaba Cloud provides Bastionhost service that allows users to centrally manage the access to cloud servers from external networks and provide secure connections to VPC resources5.

C. Use the security group function of the ECS instance, and respectively deploy ECS instances running different subsystems to independent security groups. This solution can isolate the networks between subsystems, because a security group is a virtual firewall that controls the inbound and outbound traffic of the ECS instances in the group. Users can configure security group rules to allow or deny access based on the network protocol, port, and source IP address. By deploying ECS instances running different subsystems to independent security groups, users can prevent unauthorized access or communication between the subsystems6.

The other solution is not suitable for the company’s scenario, for the following reason:

D. Create multiple ECS instances in the VPC to install subsystems of different departments- Allocate only Intranet IP addresses to all ECS instances, and deploy them in the same security groups. This solution cannot isolate the networks between subsystems, because ECS instances in the same security group can communicate with each other by default, regardless of whether they have intranet or internet IP addresses. Moreover, this solution may also prevent the ECS instances from accessing the internet or providing external services, which may affect the business operation of the company6.

References: What is a VPN? - Virtual Private Network - Cisco, VPN Gateway - Alibaba Cloud, OpenVPN - Alibaba Cloud Marketplace, Bastion Host - Alibaba Cloud Document Center, Bastionhost - Alibaba Cloud, Security groups - Elastic Compute Service - Alibaba Cloud

OSS logging is a feature that allows you to record the access requests to your OSS buckets. You can enable and configure logging for a bucket in the OSS console or by using the OSS API. When logging is enabled for a bucket A, OSS automatically generates access log objects every hour and stores them in a specified bucket B. The log objects follow a predefined naming convention that includes the source bucket name, the date, the hour, and a unique string.

The documentation also states that buckets A and B can be separate buckets or the same bucket, but they must belong to the same user1. This means that you cannot store the access logs of one user’s bucket in another user’s bucket. Therefore, the correct answer is A.

References:

1: Logging - Object Storage Service - Alibaba Cloud Documentation Center

Alibaba Cloud SLB instances are assigned a public or private IP address when created, and this IP remains unchanged for the life of the SLB instance. The IP address will only be released when the SLB instance itself is deleted.

CEN is a service that allows you to create a global network for rapidly building a distributed business system with a hybrid cloud computing solution. CEN enables you to build a secure, private, and enterprise-class interconnected network between VPCs in different regions and your local data centers1. CEN uses transit routers deployed in different regions to build a full-mesh network on top of the Alibaba Cloud global transmission network. CEN enables global network communication: The two transit routers can be connected through multiple highly available and highly reliable lines2. To establish communication between two VPCs in different regions via the intranet, you can use CEN to attach the VPCs to the transit routers in their respective regions, and then create a bandwidth plan to allocate bandwidth resources for inter-region connections3. This way, you can avoid the complexity and cost of setting up VPN or Express Connect connections between the VPCs, and enjoy the benefits of CEN, such as large-scale and on-demand networking, simplified network topology, flexible management, globally connected network, shortest-path algorithm, high redundancy, automatic route learning and advertisement, and bandwidth sharing and management2. References: Introduce Cloud Enterprise Network CEN and how … - Alibaba Cloud Academy, Cloud Enterprise Network (CEN) - Alibaba Cloud, Attach a network instance to a CEN instance - Cloud Enterprise Network - Alibaba Cloud

Zones in the same region support low-latency intranet communication, ideal for high-availability deployments with inter-Zone fault isolation. Placement of ECS instances in the same or different Zones depends on the disaster recovery and latency needs of the application.

=================

In Alibaba Cloud OSS, a bucket cannot be deleted until all contents, including files and incomplete multipart upload segments, are removed. This prevents accidental data loss by ensuring no objects remain in the bucket before deletion.

 Auto Scaling is a service that automatically adjusts the number of ECS instances based on your business needs and policies. You can use Auto Scaling to cope with unpredictable or periodic workloads. Auto Scaling supports three scaling modes: scheduled, dynamic, and fixed1. Dynamic scaling mode allows you to automatically add or remove ECS instances based on CloudMonitor metrics, such as CPU utilization, memory utilization, inbound traffic, and outbound traffic2. You can configure scaling rules and scaling policies to define the conditions and actions for dynamic scaling. For example, you can set a scaling rule to add one ECS instance when the average CPU utilization of the scaling group exceeds 80% for five consecutive minutes3. Dynamic scaling mode is suitable for scenarios where you cannot predict service changes or do not have enough historical data to set a schedule4. References:

1: Auto Scaling overview - Auto Scaling - Alibaba Cloud Documentation Center1

2: Scaling modes - Auto Scaling - Alibaba Cloud Documentation Center2

3: Create a scaling rule - Auto Scaling - Alibaba Cloud Documentation Center3

4: Auto Scaling: Automatically Adjusts Computing Resources - Alibaba Cloud5

The difference between public and private Server Load Balancers (SLBs) is that private SLBs connect to their backend ECS instances using the private network (Intranet) while public SLBs connect to their backend ECS instances using the public network (Internet). This is true according to the Alibaba Cloud documentation on SLB1. Public SLBs are used to distribute traffic from the Internet to ECS instances, while private SLBs are used to distribute traffic within a VPC or a classic network2. References: 1: Server Load Balancer - Alibaba Cloud Documentation Center 2: Create a Server Load Balancer instance - Server Load Balancer - Alibaba Cloud Documentation Center

ECS instance monitoring provides a process monitoring feature that allows you to check the status of specific processes, such as a Python process, and set alerts for automatic notifications if the process terminates unexpectedly. This method is quicker and more efficient than writing a custom script or manually logging in to the console.

Alibaba Cloud OSS (Object Storage Service) is designed for storing large volumes of unstructured data, such as files, images, and videos, making it an optimal solution for network disk applications. By migrating storage from ECS data disks to OSS, the team can offload storage tasks, reduce the number of ECS instances required, and significantly lower O&M costs. OSS also provides high scalability, reliability, and cost-effectiveness for such use cases.

Auto Scaling in Alibaba Cloud supports both Pay-As-You-Go and monthly subscription ECS instances within a scaling group. Pay-As-You-Go instances provide flexibility during traffic surges, while idle monthly subscription instances can be added manually to optimize costs and resource usage.

=================

Alibaba Cloud OSS is designed for scalable and secure object storage, allowing users to upload and download files through multiple interfaces, including the web console and APIs, offering flexibility and ease of use for developers and administrators.

=================

 A DDoS attack is a type of cyberattack that aims to exhaust the resources of a target server or network, such as bandwidth, CPU, memory, or disk space, by sending a large amount of malicious traffic or requests. This can cause the server or network to slow down, crash, or become unavailable to legitimate users. A DDoS attack is not intended to steal confidential information, crack passwords, or target databases, although these may be secondary objectives or consequences of some attacks. A DDoS attack is one of the most common and powerful threats to website security, as it can be launched from multiple sources, use various attack methods, and evade traditional defense mechanisms. According to the DDoS Attack Statistics and Trend Report by Alibaba Cloud, the proportion of volumetric attacks at 50Gbps and above has doubled, and the resources exhaustion attack reached a peak value of 3 million QPS in 2020-2021. References: DDoS Attacks: Sources, Strategies and Practices - Alibaba Cloud, DDoS Attack Statistics and Trend Report by Alibaba Cloud, Use Alibaba Cloud Anti-DDoS Service to Defend DoS Attack, Anti-DDoS Basic - Alibaba Cloud

OSS does not use a hierarchical structure for objects, but instead uses a flat structure. All elements are stored as objects in buckets. To use OSS in the same manner in which local file systems are used, you can configure Cloud Storage Gateway (CSG).

https://www.alibabacloud.c om/help/doc-detail/31817.htm

 The statement C is correct, because in an OSS bucket, all elements are stored as objects. An object is the basic unit of OSS storage. Each object consists of a unique key, data, and metadata. The key is the name of the object, which is used to identify the object in a bucket. The data is the content of the object, which can be any type of file, such as text, image, video, or audio. The metadata is the information about the object, such as its size, type, creation time, and custom attributes. References: = Object Storage Service:Overview - Alibaba Cloud