Aws Solutions Architect - Associate (4/5)

Question 1

A company has an application that posts messages to Amazon SQS, another application polls the queue and processes the messages in an l/O-intensive operation. The company has a service level agreement (SLA) that specifies the maximum amount of time that can elapse between receiving the messages and responding to the users. Due to an increase in the number of messages the company has difficulty meeting its SLA consistently. What should a solutions architect do to help improve the application's processing time and ensure it can handle the load at any level?

Accepted Answer

B.	Create an Amazon Machine Image (AMI) from the instance used for processing Terminate the instance and replace it with an Amazon EC2 Dedicated Instance.

Answer

A.	Create an Amazon Machine Image (AMI) from the instance used for processing Terminate the instance and replace it with a larger size.

Answer

C.	Create an Amazon Machine image (AMI) from the instance used for processing Create an Auto Scaling group using this image in its launch configuration Configure the group with a target tracking policy to keep us aggregate CPU utilization below 70%.

Answer

D.	Create an Amazon Machine Image (AMI) from the instance used for processing Create an Auto Scaling group using this image in its launch configuration Configure the group with a target tracking policy based on the age of the oldest message in the SQS queue.

Question 2

A company is planning to deploy an Amazon RDS DB instance running Amazon Aurora. The company has a backup retention policy requirement of 90 days Which solution should a solutions architect recommend?

Accepted Answer

A.	Set the backup retention period to 90 days when creating the RDS DB instance.

Answer

B.	Configure RDS to copy automated snapshots to a user-managed Amazon S3 bucket with a lifecycle policy set to delete after 90 days.

Answer

C.	Create an AWS Backup plan to perform a daily snapshot of the RDS database with the retention set to 90 days Create an AWS Backup job to schedule the execution of the backup plan daily.

Answer

D.	Use a daily scheduled event with Amazon CloudWatch Events to execute a custom AWS Lambda function that makes a copy of the RDS automated snapshot Purge snapshots older than 90 days.

Question 3

A company is using a tape backup solution to store its key application data offsite The daily data volume is around 50 TB The company needs to retain the backups for 7 years for regulatory purposes. The backups are rarely accessed and a week's notice is typically given if a backup needs to be restored. The company is now considering a cloud-based option to reduce the storage costs and operational burden of managing tapes The company also wants to make sure that the transition (rom tape backups to the cloud minimizes disruptions. Which storage solution is MOST cost-effective'?

Accepted Answer

A.	Use Amazon Storage Gateway to back up to Amazon Glacier Deep Archive.

Answer

B.	Use AWS Snowball Edge to directly integrate the backups with Amazon S3 Glacier.

Answer

C.	Copy the backup data to Amazon S3 and create a lifecycle policy to move the data to Amazon S3 Glacier.

Answer

D.	Use Amazon Storage Gateway to back up to Amazon S3 and create a lifecycle policy to move the backup to Amazon S3 Glacier.

Question 4

A company relies on an application that needs at least 4 Amazon EC2 instances during regular traffic and must scale up to 12 EC2 instances during peak loads. The application is critical to the business and must be highly available. Which solution will meet these requirements?

Accepted Answer

B.	Deploy the EC2 instances in an Auto Scaling group Set the minimum to 4 and the maximum to 12, with all 4 in Availability Zone A.

Answer

A.	Deploy the EC2 instances in an Auto Scaling group Set the minimum to 4 and the maximum to M, with 2 in Availability Zone A and 2 in Availability Zone B.

Answer

C.	Deploy the EC2 instances in an Auto Scaling group Set the minimum to 8 and the maximum to 12, with 4 in Availability Zone A and 4 in Availability Zone B.

Answer

D.	Deploy the EC2 instances in an Auto Scaling group Set the minimum to 8 and the maximum to 12 with all 8 in Availability Zone A.

Question 5

A company is planning to migrate its virtual server-based workloads to AWS The company has internet-facing load balancers backed by application servers. The application servers rely on patches from an internet-hosted repository. Which services should a solutions architect recommend be hosted on the public subnet ? (Select TWO.)

Accepted Answer

A.	NAT gateway

Answer

B.	Amazon RDS DB instances

Answer

C.	Application Load Balancers

Answer

D.	Amazon EC2 application servers

Answer

E.	Amazon Elastic File System (Amazon EFS) volumes

Question 6

An application is running on Amazon EC2 instances Sensitive information required for the application is stored in an Amazon S3 bucket. The bucket needs to be protected from internet access while only allowing services within the VPC access to the bucket. Which combination of actions should a solutions archived take to accomplish this'' (Select TWO.)

Accepted Answer

D.	Add an S3 ACL to the bucket that has sensitive information

Answer

A.	Create a VPC endpoint for Amazon S3.

Answer

B.	Enable server access logging on the bucket

Answer

C.	Apply a bucket policy to restrict access to the S3 endpoint.

Answer

E.	Restrict users using the IAM policy to use the specific bucket

Question 7

A solutions architect is designing a multi-Region disaster recovery solution for an application that will provide public API access. The application will use Amazon EC2 instances with a userdata script to load application code and an Amazon RDS for MySQL database. The Recovery Time Objective (RTO) is 3 hours and the Recovery Point Objective (RPO) is 24 hours.

Which architecture would meet these requirements at the LOWEST cost?

Which architecture would meet these requirements at the LOWEST cost?

Accepted Answer

A.	Use an Application Load Balancer for Region failover. Deploy new EC2 instances with the userdata script. Deploy separate RDS instances in each Region.

Answer

B.	Use Amazon Route 53 for Region failover Deploy new EC2 instances with the userdata script Create a read replica of the RDS instance in a backup Region.

Answer

C.	Use Amazon API Gateway for the public APIs and Region failover Deploy new EC2 instances with the userdata script Create a MySQL read replica of the RDS instance in a backup Region.

Answer

D.	Use Amazon Route 53 for Region failover Deploy new EC2 instances with the userdata scnpt for APIs, and create a snapshot of the RDS instance daily for a backup Replicate the snapshot to a backup Region.

Question 8

A solutions architect is designing a new API using Amazon API Gateway that will receive requests from users The volume of requests is highly variable, several hours can pass without receiving a single request The data processing will take place asynchronously but should be completed within a few seconds after a request is made. Which compute service should the solutions architect have the API invoke to deliver the requirements at the lowest cost?

Accepted Answer

C.	A containerized service hosted in Amazon Elastic Kubernetes Service (Amazon EKS).

Answer

A.	An AWS Glue job

Answer

B.	An AWS Lambda function

Answer

D.	A containerized service hosted in Amazon ECS with Amazon EC2.

Question 9

A development team needs to host a website that will be accessed by other teams. The website contents.consist of HTML. CSS, client side JavaScript, and images. Which method is the MOST cost-effective for hosting the website?

Accepted Answer

B.	Create an Amazon S3 bucket and host the website there.

Answer

A.	Containerize the website and host it in AWS Fargate.

Answer

C.	Deploy a web server on an Amazon EC2 instance to host the website.

Answer

D.	Configure an Application Load Balancer with an AWS Lambda target that uses the Express is framework.

Question 10

A company has media and application files that need to be shared internally. Users currently are authenticated using Active Directory and access files from a Microsoft Windows platform. The chief execute officer wants to keep the same user permissions, but wants the company to improve the process as the company is reaching its storage capacity limit. What should a solutions architect recommend?

Accepted Answer

B.	Configure Amazon FSx for Windows File Server and move all the media and application files.

Answer

A.	Set up a corporate Amazon S3 bucket and move and media and application files.

Answer

C.	Configure Amazon Elastic File System (Amazon EFS) and move all media and application files.

Answer

D.	Set up Amazon EC2 on Windows, attach multiple Amazon Elastic Block Store (Amazon EBS) volumes and, and move all media and application files.

Question 11

A company is moving its legacy workload to the AWS Cloud. The workload files will be shared, appended, and frequently accessed through Amazon EC2 instances when they are first created. The files will be accessed occasionally as they age What should a solutions architect recommend?

Accepted Answer

D.	Store the data using Amazon S3 with an S3 lifecycle policy enabled to move data to S3 Standard- Infrequent Access (S3 Standard-IA)

Answer

A.	Store the data using Amazon EC2 instances with attached Amazon Elastic Block Store (Amazon EBS) data volumes

Answer

B.	Store the data using AWS Storage Gateway volume gateway and export rarely accessed data to Amazon S3 storage

Answer

C.	Store the data using Amazon Elastic File System (Amazon EFS) with lifecycle management enabled for rarely accessed data

Question 12

A company is deploying a multi-instance application within AWS that requires minimal latency between the instances. What should a solutions architect recommend?

Accepted Answer

A.	Use an Auto Scaling group with a cluster placement group.

Answer

B.	Use an Auto Scaling group with single Availability Zone in the same AWS Region.

Answer

C.	Use an Auto Scaling group with multiple Availability Zones in the same AWS Region.

Answer

D.	Use a Network Load Balancer with multiple Amazon EC2 Dedicated Hosts as the targets

Question 13

A company receives structured and semi-structured data from various sources once every day A solutions architect needs to design a solution that leverages big data processing frameworks. The data should be accessible using SQL queries and business intelligence tools.
What should the solutions architect recommend to build the MOST high-performing solution?

Accepted Answer

A.	Use AWS Glue to process data and Amazon S3 to store data

Answer

B.	Use Amazon EMR to process data and Amazon Redshift to store data

Answer

C.	Use Amazon EC2 to process data and Amazon Elastic Block Store (Amazon EBS) to store data

Answer

D.	Use Amazon Kinesis Data Analytics to process data and Amazon Elastic File System (Amazon EFS) to store data

Question 14

Company is designing a website that uses an Amazon S3 bucket to store static images. The company wants to future requests have taster response times while reducing both latency and cost. Which service configuration should a solutions architect recommend?

Accepted Answer

D.	Configure Auto Scaling to automatically adjust the capacity of the website.

Answer

A.	Deploy a NAT server in front of Amazon S3.

Answer

B.	Deploy Amazon CloudFront in front of Amazon S3.

Answer

C.	Deploy a Network Load Balancer in front of Amazon S3.

Question 15

What should a solutions architect do to ensure that all objects uploaded to an Amazon S3 bucket are encrypted?

Accepted Answer

D.	Update the bucket policy to deny if the PutObject does not have an x-amz-server-side-encryption header set.

Answer

A.	Update the bucket policy to deny if the PutObject does not have an s3 x-amz-acl header set.

Answer

B.	Update the bucket policy to deny if the PutObject does not have an s3 x-amz-acl header set to private.

Answer

C.	Update the bucket policy to deny if the PutObject does not have an aws SecureTransport header set to true.

Question 16

A company runs a high performance computing (HPC) workload on AWS. The workload required low- latency network performance and high network throughput with tightly coupled node-to-node communication. The Amazon EC2 instances are properly sized for compute and storage capacity, and are launched using default options.
What should a solutions architect propose to improve the performance of the workload'?

Accepted Answer

A.	Choose a cluster placement group while launching Amazon EC2 instances.

Answer

B.	Choose dedicated instance tenancy while launching Amazon EC2 instances.

Answer

C.	Choose an Elastic Inference accelerator while launching Amazon EC2 instances.

Answer

D.	Choose the required capacity reservation while launching Amazon EC2 instances.

Question 17

A company's dynamic website is hosted using on-premises servers in the United States. The company is launching its product in Europe and it wants to optimize site loading times for new European users. The site's backend must remain in the United States. The product is being launched in a few days, and an immediate solution is needed
What should the solutions architect recommend?

Accepted Answer

A.	Launch an Amazon EC2 instance in us-east-1 and migrate the site to it.

Answer

B.	Move the website to Amazon S3 Use cross-Region replication between Regions.

Answer

C.	Use Amazon CloudFront with a custom origin pointing to the on-premises servers

Answer

D.	Use an Amazon Route 53 geoproximity routing policy pointing to on-premises servers.

Question 18

A company is building a media-sharing application and decides to use Amazon S3 for storage. When a media file is uploaded the company starts a multi-step process to create thumbnails, identify objects in the images, transcode videos into standard formats and resolutions and extract and store the metadata to an Amazon DynamoDB table. The metadata is used for searching and navigation. The amount of traffic is variable The solution must be able to scale to handle spikes in load without unnecessary expenses.
What should a solutions architect recommend to support this workload?

Accepted Answer

C.	Trigger an AWS Lambda function when an object is stored in the S3 bucket Have the Lambda function start AWS Batch to perform the steps to process the object Place the object data in the DynamoDB table when complete.

Answer

A.	Build the processing into the website or mobile app used to upload the content to Amazon S3 Save the required data to the DynamoDB table when the objects are uploaded.

Answer

B.	Trigger AWS Step Functions when an object is stored in the S3 bucket Have the Step Functions perform the steps needed to process the object and then write the metadata to the DynamoDB table.

Answer

D.	Trigger an AWS Lambda function to store an initial entry in the DynamoDB table when an object is uploaded to Amazon S3. Use a program running on an Amazon EC2 instance in an Auto Scaling group to poll the index for unprocess use the program to perform the processing.

Question 19

A company has recently updated its internal security standards. The company must now ensure all Amazon S3 buckets and Amazon Elastic Block Store (Amazon EBS) volumes are encrypted with keys created and periodically rotated by internal security specialists. The company is looking for a native, software-based AWS service to accomplish this goal.
What should a solutions architect recommend as a solution?

Accepted Answer

A.	Use AWS Secrets Manager with customer master keys (CMKs) to store master key material and apply a routine to create a new CMK periodically and replace it in AWS Secrets Manager.

Answer

B.	Use AWS Key Management Service (AWS KMS) with customer master keys (CMKs) to store master key material and apply a routing to re-create a new key periodically and replace it in AWS KMS.

Answer

C.	Use an AWS CloudHSM cluster with customer master keys (CMKs) to store master key material and apply a routine a re-create a new key periodically and replace it in the CloudHSM cluster nodes.

Answer

D.	Use AWS Systems Manager Parameter Store with customer master keys (CMKs) keys to store master key material and apply a routine to re-create a new periodically and replace it in the Parameter Store.

Question 20

A solution architect must design a solution that uses Amazon CloudFront with an Amazon S3 to store a static website. The company security policy requires that all websites traffic be inspected by AWS WAF. How should the solution architect company with these requirements?

Accepted Answer

B.	Configure Amazon CloudFront to forward all incoming requests to AWS WAF before requesting content from the S3 origin.

Answer

A.	Configure an S3 bucket policy to accept requests coming from the AWS WAF Amazon Resource Name (ARN) only.

Answer

C.	Configure a security group that allows Amazon CloudFront IP addresses to access Amazon S3 only Associate AWS WAF to CloudFront.

Answer

D.	Configure Amazon CloudFront and Amazon S3 to use an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the distribution.

Question 21

A company has copied 1 PB of data from a colocation facility to an Amazon S3 bucket in the us-east-1 Region using an AWS Direct Connect link. The company now wants to copy the data to another S3 bucket in the us-west-2 Region. The colocation facility does not allow the use AWS Snowball. What should a solutions architect recommend to accomplish this?

Accepted Answer

D.	Add a cross-Region replication configuration to copy objects across S3 buckets in different Region.

Answer

A.	Order a Snowball Edge device to copy the data from one Region to another Region.

Answer

B.	Transfer contents from the source S3 bucket to a target S3 bucket using the S3 console.

Answer

C.	Use the aws S3 sync command to copy data from the source bucket to the destination bucket.

Question 22

A company has hired a new cloud engineer who should not have access to an Amazon S3 bucket named Company Confidential. The cloud engineer must be able to read from and write to an S3 bucket called AdminTools. Which IAM policy will meet these requirements?

Accepted Answer

A.	Option A

Answer

B.	Option B

Answer

C.	Option C

Answer

D.	Option D

Question 23

An engineering team is developing and deploying AWS Lambda functions. The team needs to create roles and manage policies in AWS IAM to configure the permissions of the Lambda functions.  How should the permissions for the team be configured so they also adhere to the concept of least privilege?

Accepted Answer

A.	Create an IAM role with a managed policy attached Allow the engineering team and the Lambda functions to assume this role.

Answer

B.	Create an IAM group for the engineering team with an lAMFullAccess policy attached Add all the users from the team to this IAM group.

Answer

C.	Create an execution role for the Lambda functions. Attach a managed policy that has permission boundaries specific to these Lambda functions.

Answer

D.	Create an IAM role with a managed policy attached that has permission boundaries specific to the Lambda functions Allow the engineering team to assume this role.

Question 24

A company needs a secure connection between its on-premises environment and AWS. This connection does not need high bandwidth and will handle a small amount of traffic. The connection should be set up quickly.

What is the MOST cost-effective method to establish this type of connection?

What is the MOST cost-effective method to establish this type of connection?

Accepted Answer

D.	Implement an AWS Site-to-Site VPN connection.

Answer

A.	Implement a client VPN

Answer

B.	Implement AWS Direct Connect

Answer

C.	Implement a bastion host on Amazon EC2 53D.

Question 25

A company is building a payment application that must be highly available even during regional service disruptions A solutions architect must design a data storage solution that can be easily replicated and used in other AWS Regions. The application also requires low-latency atomicity, consistency, isolation, and durability (ACID) transactions that need to be immediately available to generate reports The development team also needs to use SQL. Which data storage solution meets these requirements'?

Accepted Answer

C.	Amazon S3 with cross-Region replication and Amazon Athena

Answer

A.	Amazon Aurora Global Database

Answer

B.	Amazon DynamoDB global tables

Answer

D.	MySQL on Amazon EC2 instances with Amazon Elastic Block Store (Amazon EBS) snapshot replication

Question 26

A solutions architect is using Amazon S3 to design the storage architecture of a new digital media application. The media files must be resilient to the loss of an Availability Zone Some files are accessed frequently while other files are rarely accessed in an unpredictable pattern. The solutions architect must minimize the costs of storing and retrieving the media files.
Which storage option meets these requirements?

Accepted Answer

B.	S3 Intelligent-Tiering

Answer

A.	S3 Standard

Answer

C.	S3 Standard-Infrequent Access {S3 Standard-IA)

Answer

D.	S3 One Zone-Infrequent Access (S3 One Zone-IA)

Question 27

A company uses a legacy on-premises analytics application that operates on gigabytes of csv files and represents months of data The legacy application cannot handle the growing size of csv files New csv files are added daily from various data sources to a central on-premises storage location. The company wants to continue to support the legacy application while users learn AWS analytics services to achieve this, a solutions architect wants to maintain two synchronized copies of all the csv files on-premises and in Amazon S3. Which solution should the solutions architect recommend?

Accepted Answer

B.	Deploy an on-premises file gateway Configure data sources to write the csv files to the file gateway Point the legacy analytics application to the file gateway The file gateway should replicate the csv files to Amazon S3.

Answer

A.	Deploy AWS DataSync on-premises. Configure DataSync to continuously replicate the csv files between the company's on-premises storage and the company's S3 bucket.

Answer

C.	Deploy an on-premises volume gateway. Configure data sources to write the csv files to the volume gateway. Point the legacy analytics application to the volume gateway. The volume gateway should replicate data to Amazon S3.

Answer

D.	Deploy AWS DataSync on-premises Configure DataSync to continuously replicate the csv files between on-premises and Amazon Elastic File System (Amazon EFS) Enable replication from Amazon EFS to the company's S3 bucket.

Question 28

An application allows users at a company's headquarters to access product data The product data is stored in an Amazon RDS MySQL DB instance. The operations team has isolated an application performance slowdown and wants to separate read traffic from write traffic. A solutions architect needs to optimize the application's performance quickly.
What should the solutions architect recommend?

Accepted Answer

D.	Create read replicas for the database Configure the read replicas with the same compute and storage resources as the source database.

Answer

A.	Change the existing database to a Multi-AZ deployment Serve the read requests from the primary Availability Zone.

Answer

B.	Change the existing database to a Multi-AZ deployment Serve the read requests from the secondary Availability Zone.

Answer

C.	Create read replicas for the database Configure the read replicas with half of the compute and storage resources as the source database.

Question 29

A company wants to optimize the cost of its data storage for data that is accessed quarterly. The company requires high throughput, low latency, and rapid access, when needed Which Amazon S3 storage class should a solutions architect recommend?

Accepted Answer

C.	Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering)

Answer

A.	Amazon S3 Glacier (S3 Glacier)

Answer

B.	Amazon S3 Standard (S3 Standard)

Answer

D.	Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

Question 30

A company requires that all versions of objects in its Amazon S3 bucket be retained Current object versions will be frequently accessed during the first 30 days, after which they will be rarely accessed and must be retrievable within 5 minutes. Previous object versions need to be kept forever, will be rarely accessed, and can be retrieved within 1 week. All storage solutions must be highly available and highly durable.  What should a solutions architect recommend to meet these requirements in the MOST cost- effective manner?

Accepted Answer

A.	Create an S3 lifecycle policy for the bucket that moves current object versions from S3 Standard storage to S3 Glacier after 30 days and moves previous object versions to S3 Glacier after 1 day.

Answer

B.	Create an S3 lifecycle policy for the bucket that moves current object versions from S3 Standard storage to S3 Glacier after 30 days and moves previous object versions to S3 Glacier Deep Archive after 1 day.

Answer

C.	Create an S3 lifecycle policy for the bucket that moves current object versions from S3 Standard storage to S3 Standard-infrequent Access (S3 Standard-IA) after 30 days and moves previous object versions to S3 Glacier Deep Archive after 1 day

Answer

D.	Create an S3 lifecycle policy for the bucket that moves current object versions from S3 Standard storage to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days and moves previous object versions to S3 Glacier Deep Archive after 1 day

Question 31

A company hosts its core network services, including directory services and DNS. in its on-premises data center. The data center is connected to the AWS Cloud using AWS Direct Connect (DX) Additional AWS accounts are planned that will require quick, cost-effective, and consistent access to these network services.
What should a solutions architect implement to meet these requirements with the LEAST amount of operational overhead?

Accepted Answer

D.	Configure AWS Transit Gateway between the accounts Assign DX to the transit gateway and route network traffic to the on-premises servers.

Answer

A.	Create a DX connection in each new account Route the network traffic to the on-premises servers.

Answer

B.	Configure VPC endpoints in the DX VPC for all required services Route the network traffic to the on-premises servers.

Answer

C.	Create a VPN connection between each new account and the DX VPp, Route the network traffic to the on-premises servers.

Question 32

A company that hosts its web application on AWS wants to ensure all Amazon EC2 instances. Amazon RDS DB instances and Amazon Redshift clusters are configured with tags. The company wants to minimize the effort of configuring and operating this check. What should a solutions architect do to accomplish this''

Accepted Answer

C.	Write API calls to check all resources for proper tag allocation. Periodically run the code on an EC2 instance.

Answer

A.	Use AWS Config rules to define and detect resources that are not property tagged.

Answer

B.	Use Cost Explorer to display resources that are not properly tagged Tag those resources manually.

Answer

D.	Write API calls to check all resources for proper tag allocation. Schedule an AWS Lambda function through Amazon CloudWatch to periodically run the code.

Question 33

An application running on an Amazon EC2 instance needs to access an Amazon DynamoDB table Both the EC2 instance and the DynamoDB table are in the same AWS account A solutions architect must configure the necessary permissions. Which solution will allow least privilege access to the DynamoDB table from the EC2 instance?

Accepted Answer

A.	Create an IAM role with the appropriate policy to allow access to the DynamoDB table Create an instance profile to assign this IAM role to the EC2 instance.

Answer

B.	Create an IAM role with the appropriate policy to allow access to the DynamoDB table Add the EC2 instance to the trust relationship policy document to allow it to assume the role.

Answer

C.	Create an IAM user with the appropriate policy to allow access to the DynamoDB table Store the credentials in an Amazon S3 bucket and read them from within the application code directly.

Answer

D.	Create an IAM user with the appropriate policy to allow access to the DynamoDB table Ensure that the application stores the IAM credentials securely on local storage and uses them to make the DynamoDB calls.

Question 34

An application uses an Amazon RDS MySQL DB instance. The RDS database is becoming low on disk space. A solutions architect wants to increase the disk space without downtime Which solution meets these requirements with the LEAST amount of effort?

Accepted Answer

A.	Enable storage auto scaling in RDS.

Answer

B.	Increase the RDS database instance size.

Answer

C.	Change the RDS database instance storage type to Provisioned IOPS.

Answer

D.	Back up the RDS database, increase the storage capacity, restore the database and stop the previous instance.

Question 35

A company has an application that runs on Amazon EC2 instances within a private subnet in a VPC The instances access data in an Amazon S3 bucket in the same AWS Region. The VPC contains a NAT gateway in a public subnet to access the S3 bucket. The company wants to reduce costs by replacing the NAT gateway without compromising security or redundancy
Which solution meets these requirements?

Accepted Answer

C.	Replace the NAT gateway with a gateway VPC endpoint.

Answer

A.	Replace the NAT gateway with a NAT instance.

Answer

B.	Replace the NAT gateway with an internet gateway.

Answer

D.	Replace the NAT gateway with an AWS Direct Connect connection.

Question 36

A company is designing a message-driven order processing application on AWS. The application consists of many services and needs to communicate the results of its processing to multiple consuming services. Each of the consuming services may take up to 5 days to receive the messages Which process will meet these requirements?

Accepted Answer

C.	The application sends the results of its processing to an Amazon Simple Queue Service (Amazon SQS) queue Each consuming service runs as an AWS Lambda function that consumes this single SQS queue.

Answer

A.	The application sends the results of its processing to an Amazon Simple Notification Service (Amazon SNS) topic Each consuming service subscribes to this SNS topic and consumes the results.

Answer

B.	The application sends the results of its processing to an Amazon Simple Notification Service (Amazon SNS) topic Each consuming service consumes the messages directly from its corresponding SNS topic.

Answer

D.	The application sends the results of its processing to an Amazon Simple Notification Service (Amazon SNS) topic. An Amazon Simple Queue Service (Amazon SQS) queue is created for each service and each queue is configured to be a subscriber of the SNS topic.

Question 37

A company stores call recordings on a monthly basis Statistically, the recorded data may be referenced randomly within a year but accessed rarely after 1 year Files that are newer than 1 year old must be queried and retrieved as quickly as possible. A delay in retrieving older files is acceptable. A solutions architect needs to store the recorded data at a minimal cost
Which solution is MOST cost-effective?

Accepted Answer

B.	Store individual files in Amazon S3 Use lifecycle policies to move the files to Amazon S3 Glacier after 1 year. Query and retrieve the files from Amazon S3 or S3 Glacier.

Answer

A.	Store individual files in Amazon S3 Glacier and store search metadata in object tags created in S3 Glacier Query S3 Glacier tags and retrieve the files from S3 Glacier.

Answer

C.	Archive individual files and store search metadata for each archive in Amazon S3 Use lifecycle policies to move the files to Amazon S3 Glacier after 1 year Query and retrieve the files by searching for metadata from Amazon S3.

Answer

D.	Archive individual files in Amazon S3 Use lifecycle policies to move the files to Amazon S3 Glacier after 1 year Store search metadata in Amazon DynamoDB Query the files from DynamoDB and retrieve them from Amazon S3 or S3 Glacier.

Question 38

A company has a highly dynamic batch processing job that uses many Amazon EC2 instances to complete it. The job is stateless in nature, can be started and stopped at any given time with no negative impact, and typically takes upwards of 60 minutes total to complete. The company has asked a solutions architect to design a scalable and cost-effective solution that meets the requirements of the job. What should the solutions architect recommend?

Accepted Answer

A.	Implement EC2 Spot Instances

Answer

B.	Purchase EC2 Reserved Instances

Answer

C.	Implement EC2 On-Demand Instances

Answer

D.	Implement the processing on AWS Lambda

Question 39

An online photo application lets users upload photos and perform image editing operations The application offers two classes of service free and paid Photos submitted by paid users are processed before those submitted by free users Photos are uploaded to Amazon S3 and the job information is sent to Amazon SQS. 
Which configuration should a solutions architect recommend?

Accepted Answer

A.	Use one SQS FIFO queue Assign a higher priority to the paid photos so they are processed first.

Answer

B.	Use two SQS FIFO queues: one for paid and one for free Set the free queue to use short polling and the paid queue to use long polling.

Answer

C.	Use two SQS standard queues one for paid and one for free Configure Amazon EC2 instances to prioritize polling for the paid queue over the free queue.

Answer

D.	Use one SQS standard queue. Set the visibility timeout of the paid photos to zero Configure Amazon EC2 instances to prioritize visibility settings so paid photos are processed first.

Question 40

A company has an application hosted on Amazon EC2 instances in two VPCs across different AWS Regions To communicate with each other, the instances use the internet for connectivity. The security team wants to ensure that no communication between the instances happens over the internet.  What should a solutions architect do to accomplish this ?

Accepted Answer

D.	Create a VPC peering connection and update the route table of the EC2 instances' subnet.

Answer

A.	Create a NAT gateway and update the route table of the EC2 instances' subnet.

Answer

B.	Create a VPC endpoint and update the route table of the EC2 instances' subnet.

Answer

C.	Create a VPN connection and update the route table of the EC2 instances' subnet.

Question 41

A company runs a production application on a fleet of Amazon EC2 instances The application reads the data from an Amazon SQS queue and processes the messages in parallel. The message volume is unpredictable and often has intermittent traffic. This application should continually process messages without any downtime.  Which solution meets these requirements MOST cost-effectively?

Accepted Answer

C.	Use Reserved Instances for the baseline capacity and use Spot Instances to handle additional capacity.

Answer

A.	Use Spot Instances exclusively to handle the maximum capacity required.

Answer

B.	Use Reserved Instances exclusively to handle the maximum capacity required.

Answer

D.	Use Reserved instances for the baseline capacity and use On-Demand Instances to handle additional capacity.

Question 42

A company with facilities in North America. Europe, and Asia is designing new distributed application to optimize its global supply chain and manufacturing process. The orders booked on one continent should be visible to all Regions in a second or less. The database should be able to support fail-over with a short Recovery Time Objective (RTO). The uptime of the application is important to ensure that manufacturing is not impacted. What should a solutions architect recommend?

Accepted Answer

A.	Use Amazon DynamoDB global tables

Answer

B.	Use Amazon Aurora Global Database

Answer

C.	Use Amazon RDS for MySQL with a cross-Region read replica

Answer

D.	Use Amazon RDS for PostgreSQL with a cross-Region read replica

Question 43

A company has several Amazon EC2 instances set up in a private subnet for security reasons These instances host applications that read and write large amounts of data to and from Amazon S3 regularly. Currently, subnet routing directs all the traffic destined for the internet through a NAT gateway. The company wants to optimize the overall cost without impacting the ability of the application to communicate with Amazon S3 or the outside internet. 
What should a solutions architect do to optimize costs?

Accepted Answer

C.	Create a VPC endpoint for Amazon S3 Attach an endpoint policy to the endpoint Update the route table to direct traffic to the VPC endpoint.

Answer

A.	Create an additional NAT gateway Update the route table to route to the NAT gateway Update the network ACL to allow S3 traffic.

Answer

B.	Create an internet gateway Update the route table to route traffic to the internet gateway Update the network ACL to allow S3 traffic.

Answer

D.	Create an AWS Lambda function outside of the VPC to handle S3 requests Attach an IAM policy to the EC2 instances, allowing them to invoke the Lambda function.

Question 44

A company hosts a training site on a fleet of Amazon EC2 instances. The company anticipates that its new course, which consists of dozens of training videos on the site, will be extremely popular when it is released in 1 week. What should a solutions architect do to minimize the anticipated server load?

Accepted Answer

C.	Store the videos in an Amazon S3 bucket Create an Amazon CloudFlight distribution with an origin access identity (OAI) of that S3 bucket Restrict Amazon S3 access to the OAI.

Answer

A.	Store the videos in Amazon ElastiCache for Redis Update the web servers to serve the videos using the Elastic ache API.

Answer

B.	Store the videos in Amazon Elastic File System (Amazon EFS) Create a user data script for the web servers to mount the EFS volume.

Answer

D.	Store the videos in an Amazon S3 bucket. Create an AWS Storage Gateway file gateway to access the S3 bucket Create a user data script for the web servers to mount the file gateway

Question 45

A company is running an online transaction processing (OLTP) workload on AWS. This workload uses an unencrypted Amazon RDS DB instance in a Multi-AZ deployment. Daily database snapshots are taken from this instance.  What should a solutions architect do to ensure the database and snapshots are always encrypted moving forward?

Accepted Answer

A.	Encrypt a copy of the latest DB snapshot. Replace existing DB instance by restoring the encrypted snapshot.

Answer

B.	Create a new encrypted Amazon Elastic Block Store (Amazon EBS) volume and copy the snapshots lo it. Enable encryption on the DB instance.

Answer

C.	Copy the snapshots and enable encryption using AWS Key Management Service (AWS KMS). Restore encrypted snapshot to an existing DB instance.

Answer

D.	Copy the snapshots to an Amazon S3 bucket that is encrypted using server-side encryption with AWS Key Management Service (AWS KMS) managed keys (SSE-KMS).

Question 46

A company is hosting its static website in an Amazon S3 bucket, which is the origin for Amazon CioudFront. The company has users in the United States. Canada, and Europe and wants to reduce costs. What should a solutions architect recommend?

Accepted Answer

A.	Adjust the CloudFront caching time to live (TTL) from the default to a longer timeframe.

Answer

B.	Implement CloudFront events with Lambda@Edge to run the website's data processing.

Answer

C.	Modify the CloudFront price class to include only the locations of the countries that are served.

Answer

D.	Implement a CloudFront Secure Sockets Layer (SSL) certificate to push security closer to the locations of the countries that are served.

Question 47

A company has a dynamic web application hosted on two Amazon EC2 instances. The company has its own SSL certificate, which is on each instance to perform SSL termination.
There has been an increase in traffic recently, and the operations team determined that SSL encryption and decryption is causing the compute capacity of the web servers to reach their maximum limit. What should a solutions architect do to increase the application's performance?

Accepted Answer

A.	Create a new SSL certificate using AWS Certificate Manager (ACM). Install the ACM certificate on each instance.

Answer

B.	Create an Amazon S3 bucket. Migrate the SSL certificate to the S3 bucket. Configure the EC2 instances to reference the bucket for SSL termination.

Answer

C.	Create another EC2 instance as a proxy server. Migrate the SSL certificate to the new instance and configure it to direct connections to the existing EC2 instances.

Answer

D.	Import the SSL certificate into AWS Certificate Manager (ACM). Create an Application Load Balancer with an HTTPS listener that uses the SSL certificate from ACM.

Question 48

A company runs a static website through its on-premises data center. The company has multiple servers mat handle all of its traffic, but on busy days, services are interrupted and the website becomes unavailable. The company wants to expand its presence globally and plans to triple its website traffic. What should a solutions architect recommend to meet these requirements?

Accepted Answer

A.	Migrate the website content to Amazon S3 and host the website on Amazon CloudFront.

Answer

B.	Migrate the website content to Amazon EC2 instances with public Elastic IP addresses in multiple AWS Regions.

Answer

C.	Migrate the website content to Amazon EC2 instances and vertically scale as the load increases.

Answer

D.	Use Amazon Route 53 to distribute the loads across multiple Amazon CloudFront distributions for each AWS Region that exists globally.

Question 49

A company uses Amazon Redshift for its data warehouse. The company wants to ensure high durability for its data in case of any component failure. What should a solutions architect recommend?

Accepted Answer

A.	Enable concurrency seating.

Answer

B.	Enable cross-Region snapshots.

Answer

C.	Increase the data retention period.

Answer

D.	Deploy Amazon Redshift in Multi-AZ

Question 50

A development team is collaborating with another company to create an integrated product. The other company needs to access an Amazon Simple Queue Service (Amazon SQS) queue that is contained in the development team's account. The other company wants to poll the queue without giving up its own account permissions to do. How should a solutions architect provide access to the SQS queue?

Accepted Answer

C.	Create an SQS access policy that provides the other company access to the SQS queue.

Answer

A.	Create an instance profile that provides the other company access to the SQS queue.

Answer

B.	Create an IAM policy that provides the other company access to the SQS queue.

Answer

D.	Create an Amazon Simple Notification Service (Amazon SNS) access policy that provides the other company access to the SQS queue.

Question 51

As part of budget planning, management wants a report of AWS billed items listed by user. The data will be used to create department budgets. A solutions architect needs to determine the most efficient way to obtain this report information. Which solution meets these requirements?

Accepted Answer

B.	Create a report in Cost Explorer and download the report.

Answer

A.	Run a query with Amazon Athena to generate the report.

Answer

C.	Access the bill details from the billing dashboard and download the bill.

Answer

D.	Modify a cost budget in AWS Budgets to alert with Amazon Simple Email Service (Amazon SES).

Question 52

A company has a hybrid application hosted on multiple on-premises servers with static IP addresses. There is already a VPN that provides connectivity between the VPC and the on-premises network. The company wants to distribute TCP traffic across the on-premises servers for internet users. What should a solutions architect recommend to provide a highly available and scalable solution?

Accepted Answer

B.	Launch an internet-facing Application Load Balancer (ALB) and register on-premises IP addresses with the ALB.

Answer

A.	Launch an internet-facing Network Load Balancer (NLB) and register on-premises IP addresses with the NLB.

Answer

C.	Launch an Amazon EC2 instance, attach an Elastic IP address, and distribute traffic to the on- premises servers.

Answer

D.	Launch an Amazon EC2 instance with public IP addresses in an Auto Scaling group and distribute traffic to the on-premises servers.

Question 53

A company is reviewing a recent migration of a three-tier application to a VPC. The security team discovers thai the principle of least privilege is not being applied to Amazon EC2 security group ingress and egress rules between the application tiers. What should a solutions architect do to correct this issue?

Accepted Answer

A.	Create security group rules using the instance ID as the source or destination.

Answer

B.	Create security group rules using the security group ID as the source or destination.

Answer

C.	Create security group rules using the VPC CIDR blocks as the source or destination.

Answer

D.	Create security group rules using the subnet CIDR blocks as the source or destination.

Question 54

A company runs a web service on Amazon EC2 instances behind an Application Load Balancer The instances run in an Amazon EC2 Auto Scaling group across two Availability Zones The company  needs a minimum of four instances at all limes to meet the required service level agreement (SLA) while keeping costs low. If an Availability Zone fails, how can the company remain compliant with the SLA?

Accepted Answer

D.	Change the Auto Scaling group to use eight servers across two Availability Zones.

Answer

A.	Add a target tracking scaling policy with a short cooldown period.

Answer

B.	Change the Auto Scaling group launch configuration to use a larger instance type.

Answer

C.	Change the Auto Scaling group to use six servers across three Availability Zones.

Question 55

A company has applications hosted on Amazon EC2 instances with IPv6 addresses. The applications must initiate communications with other external applications using the internet. However, the company's security policy states that any external service cannot initiate a connection to the EC2 instances. What should a solutions architect recommend to resolve this issue?

Accepted Answer

D.	Create an egress-only internet gateway and make it the destination of the subnet's route table

Answer

A.	Create a NAT gateway and make it the destination of the subnet's route table

Answer

B.	Create an internet gateway and make it the destination of the subnet's route table

Answer

C.	Create a virtual private gateway and make it the destination of the subnet's route table

Question 56

A company wants to build a scalable key management infrastructure to support developers who need to encrypt data in their applications. What should a solutions architect do to reduce the operational burden?

Accepted Answer

B.	Use AWS Key Management Service (AWS KMS) to protect the encryption keys

Answer

A.	Use multi-factor authentication (MFA) to protect the encryption keys

Answer

C.	Use AWS Certificate Manager (ACM) to create, store and assign the encryption keys

Answer

D.	Use an 1AM policy to limit the scope of users who have access permissions to protect the encryption keys

Question 57

A company is using Site-to-Site VPN connections for secure connectivity to its AWS Cloud resources from on premises. Due to an increase in traffic across the VPN connections to the Amazon EC2 instances, users are experiencing slower VPN connectivity Which solution will improve the VPN throughput?

Accepted Answer

A.	Implement multiple customer gateways for the same network to scale the throughput.

Answer

B.	Use a transit gateway with equal cost multipath routing and add additional VPN tunnels.

Answer

C.	Configure a virtual private gateway with equal cost multipath routing and multiple channels.

Answer

D.	Increase the number of tunnels in the VPN configuration to scale the throughput beyond the default limit.

Question 58

An application running on an Amazon EC2 instance needs to securely access tiles on an Amazon Elastic File System (Amazon I tile system. The EFS tiles are stored using encryption at rest. Which solution for accessing the tiles is MOST secure?

Accepted Answer

A.	Enable TLS when mounting Amazon EFS

Answer

B.	Store the encryption key in the code of the application

Answer

C.	Enable AWS Key Management Service (AWS KMS) when mounting Amazon EFS.

Answer

D.	Store the encryption key in an Amazon S3 bucket and use 1AM roles to grant the EC2 instance access permission.

Question 59

A company is planning to migrate a legacy application to AWS. The application currently uses NFS to communicate to an on-premises storage solution to store application data. The application cannot be modified to use any other communication protocols other than NFS for this purpose. Which storage solution should a solutions architect recommend for use after the migration?

Accepted Answer

C.	Amazon Elastic File System (Amazon EFS)

Answer

A.	AWS DataSync

Answer

B.	Amazon Elastic Block Store (Amazon EBS)

Answer

D.	Amazon EMR File System (Amazon EMRFS)

Question 60

A company has a custom application with embedded credentials that retrieves information from an Amazon RDS MySQL DB instance. Management says the application must be made more secure with the least amount of programming effort. What should a solutions architect do to meet these requirements?

Accepted Answer

D.	Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Parameter Store.

Answer

A.	Use AWS Key Management Service (AWS KMS) customer master keys (CMKs) to create keys. Configure the application to load the database credentials from AWS KMS Enable automatic key rotation.

Answer

B.	Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Create an AWS Lambda function that rotates the credentials in Secret Manager.

Answer

C.	Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Secrets Manager.

Question 61

A company is migrating a Linux-based web server group to AWS The web servers must access files in a shared file store for some content To meet the migration date, minimal changes can be made. What should a solutions architect do to meet these requirements?

Accepted Answer

C.	Create an Amazon Elastic File System (Amazon EFS) volume and mount it on all web servers

Answer

A.	Create an Amazon S3 Standard bucket with access to the web server.

Answer

B.	Configure an Amazon CloudFront distribution with an Amazon S3 bucket as the origin

Answer

D.	Configure Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS SSD (io1) volumes and mount them on all web servers.

Question 62

A company has an API-based inventory reporting application running on Amazon EC2 instances The application stores information in an Amazon DynamoDB table The company's distribution centers have an on-premises shipping application that calls an API to update the inventory before printing shipping labels. The company has been experiencing application interruptions several times each day, resulting in lost transactions. What should a solutions architect recommend to improve application resiliency?

Accepted Answer

A.	Modify the shipping application to write to a local database

Answer

B.	Modify the application APIs to run serverless using AWS Lambda

Answer

C.	Configure Amazon API Gateway to call the EC2 inventory application APIs.

Answer

D.	Modify the application to send inventory updates using Amazon Simple Queue Service (Amazon SQS)

Question 63

A solutions architect needs to ensure that all Amazon Elastic Block Store (Amazon EBS) volumes restored from unencrypted EBS snapshots are encrypted What should the solutions architect do to accomplish this?

Accepted Answer

A.	Enable EBS encryption by default for the AWS Region

Answer

B.	Enable EBS encryption by default for the specific volumes

Answer

C.	Create a new volume and specify the symmetric customer master key (CMK) to use for encryption

Answer

D.	Create a new volume and specify the asymmetric customer master key (CMK) to use for encryption.

Question 64

A company wants to host its web application on AWS using multiple Amazon EC2 instances across different AWS Regions Since the application content will be specific to each geographic region, the client requests need to be routed to the server that hosts the content for that clients Region. What should a solutions architect do to accomplish this?

Accepted Answer

C.	Configure Amazon Route 53 with a geolocation routing policy

Answer

A.	Configure Amazon Route 53 with a latency routing policy.

Answer

B.	Configure Amazon Route 53 with a weighted routing policy.

Answer

D.	Configure Amazon Route 53 with a multivalue answer routing policy

Aws Solutions Architect - Associate (4/5)

Fragen in diesem Quiz (65)

Informationen

Feedback

Wie gefällt dir das neue Design?