ACP-Cloud1 Exam Dumps : ACP Cloud Computing Certification

To meet the company’s security requirements, the following solutions should be used together:

A. Enable the VPN on the bastion host (or directly use the VPN image on Alibaba Cloud Marketplace). The administrator uses VPN encrypted communication during O&M. This solution can support secure remote O&M, because VPN (Virtual Private Network) is a technology that creates a secure and encrypted connection over the Internet between the bastion host and the administrator’s device. VPN can protect the data transmitted between the bastion host and the administrator from being intercepted or tampered by malicious third parties1. Alibaba Cloud provides VPN Gateway service that allows users to create VPN connections between VPCs and on-premises data centers, or between VPCs in different regions2. Users can also use VPN images from Alibaba Cloud Marketplace, such as OpenVPN, to create VPN servers on ECS instances3.

B. Build an independent ECS instance as the bastion host or remote logon and O&M, and authorize the bastion host to access ECS instances running other subsystems. This solution can also support secure remote O&M, because a bastion host is a special-purpose ECS instance that acts as a proxy or a gateway for accessing other ECS instances in the VPC. A bastion host can enhance the security of the ECS instances by limiting the exposure of the ECS instances to the public network, and by implementing security policies and monitoring tools on the bastion host4. Alibaba Cloud provides Bastionhost service that allows users to centrally manage the access to cloud servers from external networks and provide secure connections to VPC resources5.

C. Use the security group function of the ECS instance, and respectively deploy ECS instances running different subsystems to independent security groups. This solution can isolate the networks between subsystems, because a security group is a virtual firewall that controls the inbound and outbound traffic of the ECS instances in the group. Users can configure security group rules to allow or deny access based on the network protocol, port, and source IP address. By deploying ECS instances running different subsystems to independent security groups, users can prevent unauthorized access or communication between the subsystems6.

The other solution is not suitable for the company’s scenario, for the following reason:

D. Create multiple ECS instances in the VPC to install subsystems of different departments- Allocate only Intranet IP addresses to all ECS instances, and deploy them in the same security groups. This solution cannot isolate the networks between subsystems, because ECS instances in the same security group can communicate with each other by default, regardless of whether they have intranet or internet IP addresses. Moreover, this solution may also prevent the ECS instances from accessing the internet or providing external services, which may affect the business operation of the company6.

References: What is a VPN? - Virtual Private Network - Cisco, VPN Gateway - Alibaba Cloud, OpenVPN - Alibaba Cloud Marketplace, Bastion Host - Alibaba Cloud Document Center, Bastionhost - Alibaba Cloud, Security groups - Elastic Compute Service - Alibaba Cloud

A route table is a set of rules that determine how network traffic is routed within a VPC or between different network instances1. A VRouter is a hub that connects all VSwitches in the same VPC and enables communication between them2. When you create a VPC, a VRouter and a default route table are automatically created for the VPC1. The default route table contains system routes that are automatically generated by the system based on the network topology1. The system routes cannot be modified or deleted1.

However, you can also create custom route tables for your VPC and add custom routes to them1. Custom routes are manually configured by users to route traffic to specific destinations, such as other VPCs, VBRs, VPN Gateways, or NAT Gateways1. Custom routes can be modified or deleted as needed1. You can also associate VSwitches with different route tables to implement fine-grained routing control1.

Therefore, the statement that the routing entries of the route table can not be modified manually is not correct, as it only applies to system routes, not custom routes. The other statements are correct, as each VRouter may have multiple route tables, one default and several custom1; when a VPC is deleted, the corresponding route table is also deleted3; and the default route table cannot be deleted1. References: Route table overview - Virtual Private Cloud - Alibaba Cloud Documentation Center, VRouter overview - Virtual Private Cloud - Alibaba Cloud Documentation Center, Delete a VPC - Virtual Private Cloud - Alibaba Cloud Documentation Center

With a measurement cycle of 5 minutes and a requirement for five consecutive cycles where disk usage exceeds 80%, it would take 5×5=255 \times 5 = 255×5=25 minutes for CloudMonitor to confirm the condition. After confirmation, CloudMonitor typically processes and sends the alert, which may take an additional 5 minutes, totaling approximately 30 minutes before you receive the alert.