Test
a3
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (100)
1When an EC2 instance that is backed by an s3based AMI is terminated .What happens to the data on the root volume?
- AData is unavailable until the instance is restarted
- BData is automatically deleted
- CData is automatically saved as an EBS snapshot
- DData is automatically saved as an EBS volume
2Which of the following notification endpoints or clients are supported by Amazon Simple
Notification Service? Choose 2 answers- AEmail
- BCloudFront distribution
- CFile Transfer Protocol
- DShort Message Service
- ESimple Network Management Protocol
3A gaming application is heavily dependent o caching and uses Amazon ElasticCache for
Redis. The application performance was recently degraded due to failure of the cache node.
What should a Solutions Architect recommend to minimize performance degradation it the future?- AMigrate from ElasticCache to Amazon RDS
- BConfigure automatic backup to save cache data
- CConfigure ElasticCache Multi-AZ with automatic failover
- DUse Auto Scaling to provision cache nodes based on CPU usage
4A Solution Architect is considering possible options for improving the security of the data stored on an Amazon EBS volume attacked to an Amazon EC2 instance.
Which solution will improve the security of the data?- AUse AWS KMS to encrypt the EBS volume.
- BCreate an IAM policy that restricts read and write access to the volume.
- CMigrate the sensitive data to an instance store volume.
- DUse Amazon single-on to control login access to the EC2 instance.
5A three-tier application is being created to host small news articles. The application is
expected to serve millions of users. When breaking news. Which design meets these requirements while minimizing costs?- AUse Auto Scaling groups to increase the number of Amazon EC2 instances delivering the web application.
- BUse Auto Scaling groups to increase the size of the Amazon RDS instances delivering the database
- CUse Amazon DynamoDB strongly consistent reads to adjust for the increase in traffic.
- DUse Amazon DynamoDB Accelerator (DAX) to cache read operations to the database
- Ethe site must handle very large spikes in traffic without significantly impacting database.
6An application server needs to be in a private subnet without access to the internet. The
solution must retrieve and files to an Amazon S3 bucket.
How should a Solution Architect design a solution to meet these requirements?- AUse Amazon S3 VPC endpoints
- BDeploy a proxy server
- CUse a NAT Gateway
- DUse a private Amazon S3 bucket
7You have created an API powered by API Gateway and AWS Lambda. Because of a new
feature release, you expect traffic volume on your API to increase 10-fold. Which configuration should you use?- AUse one Lambda function with API gateway as the trigger. Increase the amount of memory configured for the lambda function
- BUse one Lambda function with API gateway as the trigger. AWS Lambda will allocate capacity to match the rate of incoming events
- CUse multiple API Gateway endpoints, each triggering a Lambda function. You are charged per call, not per endpoint
- DUse multiple copies of the Lambda function, each with API gateway as th trigger. You are charged per request, not per function
8A Solutions Architect is designing a system that will store Personally Identifiable Information (PII) in an Amazon S3 bucket. Due to compliance and regulatory requirements, both the master keys and unencrypted data should never be sent to AWS.
What Amazon S3 encryption technique should the Architect choose?- AAmazon S3 client-side encryption with an AWS KMS-managed customer master key (CMK)
- BAmazon S3 server-side encryption with an AWS KMS-managed key
- CAmazon S3 client-side encryption with a client-side master key
- DAmazon S3 server-side encryption with a customer-provided key
9A company is building a two-tier web application to serve dynamic transaction-based
content. The data tier is leveraging an online transactional processing (OLTP) database. What services should you leverage to enable an elastic and scalable web tier?- AElastic Load Balancing, Amazon EC2, and Auto Scaling
- BElastic Load Balancing, Amazon RDS with Multi-AZ, and Amazon S3
- CAmazon RDS with Multi-AZ and Auto Scaling
- DAmazon EC2, Amazon DynamoDB, and Amazon S3
10A company had decided to store its critical data on the AWS Cloud. Newly uploaded data is frequently accessed for a period of one month, after which the data is no longer frequently accessed.
However, there is a requirement for older objects with a specific prefix to be accessed within milliseconds.
What services and features should the company use to meet this requirement is a durable, available, and cost-effective manner?- AUse the S3 Standard storage class to store the objects for the initial month. After one month, use
lifecycle transition policies to change the storage class for objects with the prefix to S3 STANDARD_IA
and the rest of the data to Amazon Glacier - BUse the S3 Standard storage class to store the objects for the initial month. After one month, use
lifecycle transition policies to change the storage class for all data to Amazon Glacier - CUse the S3 STANDARD_IA storage class to store the objects for the initial month. After one month,
use lifecycle transition policies to change the storage class for the objects with the prefix to S3
ONEZONE_IA and the rest of the data to Amazon Glacier - DUse the S3 STANDARD_IA storage class to store the objects for the initial month. After one month,
use lifecycle transition policies to change the storage class for all data to S3 ONEZONE_IA
- AUse the S3 Standard storage class to store the objects for the initial month. After one month, use
11A company uses Amazon S3 for storing a variety of files. A Solutions Architect needs to
design a feature that will allow users to instantly restore any deleted files within 30 days of deletion.
Which is the Most cost-efficient solution?- ACreate lifecycle policies that move the objects to Amazon Glacier and delete them after 30 days
- BEnable cross-region replication. Empty the replica bucket every 30 days using an AWS Lambda function
- CEnable versioning and create a lifecycle policy to remove expired versions after 30 days
- DEnable versioning and MFA Delete. Using a Lambda function, remove MFA delete from objects
more than 30 days old
12A Solutions Architect is building an application that stores object data. Compliance
requirements state that the data stored is immutable.
Which service meets these requirements?- AAmazon S3
- BAmazon Glacier
- CAmazon EFS
- DAWS Storage Gateway
13A company has an AWS account that contains three VPCs (Dev, Test, and Prod) in the same region. Test is peered to both prod and Dev. All VPCs have non-overlapping CIDR blocks. The company wants to push minor code releases from Dev to Prod to speed up time to market. Which of the following options helps the company accomplish this?
- ACreate a new peering connection between Prod and Dev along with appropriate routes
- BCreate a new entry to Prod in the Dev route table using the peering connection as the target
- CAttach a security gateway to Dev. Add a new entry in the Prod route table identifying the gateway as the target
- DThe VPCs have non-overlapping CIDR blocks in the same account. The route tables contain local routes for all VPCs
14You are working with a customer who has 10 TB of archival data that they want to migrate to Amazon glacier.
The customer has a 1-Mbps connection to the internet. Which service or feature provides the fastest method of getting the data into Amazon glacier?- AAmazon Glacier multipart upload
- BAWS storage Gateway
- CVM Import/Export
- DAWS Import/Export
15A client is migrating a legacy web application to the AWS Cloud. The current system uses an Oracle database as a relational database management system solution. Backups occur every night, and the data is stored onpremises. The Solutions Architect must automate the backups and identity a storage solution while keeping costs low.
Which AWS service will meet these requirements?- AAmazon RDS
- BAmazon RedShift
- CAmazon DynamoDB Accelerator
- DAmazon ElastiCache
16A Solutions Architect notices slower response times from an application. The CloudWatch metrics on the MySQL RDS indicate Read IOPS are high and fluctuate significantly when the database is under load.
How should the database environment be re-designed to resolve the IOPS fluctuation?- AChange the RDS instance type to get more RAM.
- BChange the storage type to Provisioned IOPS.
- CScale the web server tier horizontally.
- DSplit the DB layer into separate RDS instances.
17A media company has deployed a multi-tier architecture on AWS. Web servers are deployed in two Availability Zones using an Auto Scaling group with a default Auto Scaling termination policy.
The web servers' Auto Scaling group currently has 15 instances running.
Which instance will be terminated first during a scale-in operation?- AThe instance with the oldest launch configuration.
- BThe instance in the Availability Zone that has most instances.
- CThe instance closest to the next billing hour.
- DThe oldest instance in the group.
18You have a load balancer configured for VPC, and all backend Amazon EC2 instances are in service.
However, your web browser times out when connecting to the load balancer's DNS name. Which options are probable causes of this behaviour?- AThe load balancer was not configured to use a public subnet with an Internet gateway configured
- BThe Amazon EC2 instances do not have a dynamically allocated private IP address
- CThe security groups or network ACLs are nor properly configured for web traffic
- DThe load balancer is not configured in a private subnet with a NAT instance
- EThe VPC does not have a VGW configured
19A company wants to expand its web services from us-east-1 into ap-southeast-1. The
company stores a large amount of static content on its website, and recently received complaints about slow loading speeds and the website timing out.
What should be done to meet the expansion goal while also addressing the latency and timeout issues?- AStore the static content in Amazon S3 and enable S3 Transfer Acceleration.
- BStore the static content in an Amazon EBS volume in the ap-southeast-1 region and provision larger Amazon EC2 instances for the website.
- CUse an Amazon Route 53 simple routing policy to distribute cached content across three regions.
- DUse Amazon S3 to store the static content and configure an Amazon CloudFront distribution.
20A Solutions Architect is designing a microservice to process records from Amazon Kinesis Streams. The metadata must be stored a Amazon DynamoDB. The microservice most be capable of concurrently processing 10.000 records daily as they arrive in the Kinesis stream.
The MOST scalable way to design the microservice is:- AAs an AWS Lambda function
- BAs a process on an Amazon EC2 instance.
- CAs a Docker container running on Amazon ECS
- DAs a Docker container on an EC2 instance
21Which of the following instance types are available as Amazon EBS backend only?
- AGeneral purpose T2
- BGeneral purpose M3
- CCompute-optimized C4
- DCompute-optimized C3
- EStorage-optimized 12
22You are tasked with migrating a high throughput, distributed, fault-tolerent NoSQL data store to AWS. The system is extremely disk-IO intensive. Which instance family is best suited for this workload?
- AI2
- BT2
- CHS!
- DR3
23A Solutions Architect is designing an application that requires having six Amazon EC2
instances running at all times. The application will be deployed in the sa-east-1 region, which has three Availability Zones: sa-east-la, sa-east-1b, and sa-east-1c.
Which action will provide 100 percent fault tolerance and the LOWEST cost in the event that one Availability Zone in the region becomes unavailable?- ADeploy six Amazon EC2 instances in sa-east-1a, six Amazon EC2 instances in sa-east-1b, and six Amazon EC2 instances in sa-east-lc.
- BDeploy six Amazon EC2 instances in sa-east-1a, four Amazon EC2 instances in sa-east-lb, and two Amazon EC2 instances in sa-east-1c.
- CDeploy three Amazon EC2 instances in sa-east-1a, three Amazon EC2 instances in sa-east-1b, and three Amazon EC2 instances in sa-east-1c.
- DDeploy two Amazon EC2 instances in sa-east-1a, two Amazon EC2 instances in sa-east-1b, and two Amazon EC2 instances in sa-east-1c.
24As part of securing an API layer but on Amazon API Gateway, a Solutions Architect has to authorize users who are currently authenticated by an existing identity provider. The users must be denied access for a period of one hour after three unsuccessful attempts.
How can be Solutions Architect meet these requirements?- AUse AWS IAM authorization and add least-privileged permissions to each respective IAM role
- BUse an API Gateway custom authorizer to invoke an AWS Lambda function to validate each user's identity
- CUse Amazon Cognito user pools to provide built-in user management
- DUse Amazon Cognito user pools to integrate with external identity providers
25A company is deploying a two-tier, highly available web application to AWS. Which service
provides durable storage for static content while utilizing lower overall CPU resources for web tier?- AAmazon S3
- BAmazon EBS volume
- CAmazon RDS instance
- DAmazon EC2 instance store
26You have a CloudFront distribution configured with the following path patterns:
When users request objects that start with 'static2/', they are receiving 404 response codes. What might be the problem?- AThe "*" path pattern must appear before 'static1/*' path
- BCloudFront distributions cannot have origins in different AWS regions
- CCloudFront distributions cannot have multiple different origin types
- DThe '*' path pattern must appear after the 'static2/*' path
27A company is evaluating Amazon S3 as a data storage solution for their daily analyst reports.
The company has implemented stringent requirements concerning the security of the data at test Specifically, the CISO asked for the use of envelope encryption with separate permissions for the use of an envelope key, automated rotation of the encryption keys, and visibility into when an encryption key was used and by whom.
Which steps should a Solutions Architect take to satisfy the security requirements requested by the CISO?- ACreate an Amazon S3 bucket to store the reports and use Server-Side Encryption with Customer-
Provided Keys (SSE-C) - BCreate an Amazon S3 bucket to store the reports and use Server-Side Encryption with Amazon
S3Managed Keys (SSE-S3) - CCreate an Amazon S3 bucket to store the reports and use Server-Side Encryption with AWS KMS-
Managed Keys (SSE-KMS) - DCreate an Amazon S3 bucket to store the reports and use Amazon S3 versioning with Server- Side
Encryption with Amazon S3-Managed Keys (SSE-S3)
- ACreate an Amazon S3 bucket to store the reports and use Server-Side Encryption with Customer-
28NO.128 You have a web application running on six Amazon EC2 instances, consuming about 45% of resources on each instance. You are using autoscaling to make sure that six instances are running at all times. The number of requests this application processes is consistent and does not experience spikes. The application is critical to your business and you want high availability at all times. you want the load to be distributed evenly between all instances. you also want to use the same Amazon Machine image(AMI) for all instances .which of the following architectural choices should you make?
- ADeploy 2 EC2 instances in three regions and use Amazon Elastic Load Balancer
- BDeploy 6 EC2 instances in one availability zone and use Amazon Elastic Load Balancer
- CDeploy 3 EC2 instances in one availability zone and 3 in another availability zone and use Amazon Elastic Load Balancer
- DDeploy 3 EC2 instances in one region and 3 in another region and use Amazon Elastic Load Balancer
29A company is using an Amazon S3 bucket located in us-west-2 to serve videos to their
customers. Their customers are located all around the world and the videos are requested a lot during peak hours. Customers in Europe complain about experiencing slow downloaded speeds, and during peak hours, customers in all locations report experiencing HTTP 500 errors.
What can a Solutions Architect do to address these issues?- APlace an elastic load balancer in front of the Amazon S3 bucket to distribute the load during peak hours.
- BCache the web content with Amazon CloudFront and use all Edge locations for content delivery.
- CReplicate the bucket in eu-west-1 and use an Amazon Route 53 failover routing policy to determine which bucket it should serve the request to.
- DUse an Amazon Route 53 weighted routing policy for the CloudFront domain name to distribute the GET request between CloudFront and the Amazon S3 bucket directly.
30A Solutions Architect is creating a new relational database. The Compliance team will use the database and mandates that data content must be stored across three different Availability Zones. Which of the following options should the Architect use?
- AAmazon Aurora
- BAmazon RDS MySQL with Multi-AZ enabled
- CAmazon DynamoDB
- DAmazon ElastiCache
31What is one key difference between an Amazon EBSbacked and an instancestore backed
instance?- AAmazon EBS-backed instances can be stopped and restarted
- BInstance-store backed instances can be stopped and restarted
- CAuto scaling requires using Amazon EBS-backed instances
- DVirtual Private Cloud requires EBS backed instances
32You have an environment that consists of a public subnet using Amazon VPC and 3 instances that are running in this subnet. These three instances can successfully communicate with other hosts on the internet. you launch a fourth instance in the same subnet, using the same AMI and security group configuration you used for the others, but find that this instance cannot be accessed from the internet. What should you do to enable internet access?
- AConfigure a publically routable IP Address in the host OS of the fourth instance
- BDeploy a NAT instance into the public subnet
- CModify the routing table for the public subnet
- DAssign an elastic IP address to the fourth instance
33What Is the MOST cost-efficient way to host a scalable website with only static content?
- AAn Auto Scaling group
- BAn Amazon EC2 instance
- CAn Amazon S3 bucket
- DAn Elastic Beanstalk stack
34A company requires that the source, destination, and protocol of all IP packets be recorded when traversing a private subnet.What is the MOST secure and reliable method of accomplishing this goal.
- ACreate VPC flow logs on the subnet.
- BEnable source destination check on private Amazon EC2 instances.
- CEnable AWS CloudTrail logging and specify an Amazon S3 bucket for storing log files.
- DCreate an Amazon CloudWatch log to capture packet information.
35An application on an Amazon EC2 instance routinely stops responding to requests and
requires a reboot to recover. The application logs are already exported into Amazon CloudWatch,
and you notice that the problem consistently follows the appearance of a specific message in the log.
The application team is working to address the bug, but has not provided a date for the fix.
What workaround can you implement to automate recovery of the instance until the fix is deployed?- ACreate an Amazon CloudWatch alarm on instance memory usage; based on that alarm, trigger an
Amazon CloudWatch action to reboot the instance - BCreate a AWS CloudTrail alarm on low CPU; based on that alarm, trigger an Amazon SNS message
to the Operations team - CCreate an Amazon CloudWatch alarm on an Amazon CloudWatch Logs for that message; based on
that alarm, trigger an Amazon CloudWatch action to reboot the instance - DCreate an AWS CloudTrail alarm to detect the deadlock; based on that alarm, trigger an Amazon
SNS message to the Operations team
- ACreate an Amazon CloudWatch alarm on instance memory usage; based on that alarm, trigger an
36A photo-sharing service stores pictures in Amazon Simple Storage Service (S3) and allows application sign-in using an OpenID Connect-compatible identity provider. Which AWS Security Token Service approach to temporary access should you use for the Amazon S3 operations?
- ASAML-based Identity Federation
- BCross-Account Access
- CAWS Identity and Access Management roles
- DWeb Identity Federation
37 During performance testing of an application, the Amazon RDS database caused a
performance bottleneck.
What steps can be taken to improve the database performance? (Choose two.)- AChange the RDS database instance to multiple Availability Zones.
- BScale up to a larger RDS instance type.
- CRedirect read queries to RDS read replicas.
- DScale out using an Auto Scaling group for RDS.
- EUse RDS in a separate AWS Region.
38A Solution Architect is building an application that will run for eight hours, Monday through
Friday. This application will also run a weekly batch process every Saturday night that consistently
takes four hours to complete.
Which is the MOST cost- effective computer solution?- ASpot Instances
- BStandard Reserved Instances
- COn-Demand Instances
- DScheduled Reserved Instances
39A company has an application that accesses a MySQL database installed on a single EC2
instance. The instance recently experienced a fault and brought down the entire application for
several hours. The company wants to address the issue but is concerned about spending too much
time modifying application code or managing the legacy application.
What should the Solutions Architect recommend to remove this single point of failure with the
FEWEST changes to the application code and the LEAST amount of administrative effort?- AImplement a caching layer by using Amazon ElastiCache to store query results of frequently
accessed information. - BDeploy a second EC2 instance with MySQL installed, and configure replication between this
instance and the existing MySQL instance. - CMigrate the database to an RDS MySQL Multi-AZ DB instance, and point the application servers to
the new RDS instance. - DCreate a DynamoDB table to use as a cache layer, and update the application to query data from
Amazon DynamoDB before querying MySQL.
- AImplement a caching layer by using Amazon ElastiCache to store query results of frequently
40An application stores data in a My SQL database hosted on an EC2 instance. A Solutions
Architect must address reports of high latency and dropped requests. The web tier EC2 instances are
mostly idle, but the database instance has a large number of read requests that result in a large-disk
read queue.
Which solution will address the problems?- AProvision all the EC2 instances, both web tier and database, in a placement group
- BProvision a database replica, and place a Network Load Balancer in front of both databases
- CImport the database into a Multi-AZ RDS instance, and direct the read-only queries to the standby
instance - DCache database query results in an Amazon ElastiCache cluster, and check the cluster for cached
results before calling the database
41A company has an application that uses Amazon CloudFront for content that is hosted on an
Amazon S3 bucket. After an unexpected refresh, the users are still seeing old content.
Which step should the Solutions Architect take to ensure that new content is displayed?- APerform a cache refresh on the CloudFront distribution that is serving the content.
- BPerform an invalidation on the CloudFront distribution that is serving the content.
- CCreate a new cache behavior path with the updated content.
- DChange the TTL value for removing the old objects
42A customer is running a multi-tier web application farm in a virtual private cloud (VPC) that
is not connected to their corporate network. They are connecting to the VPC over the Internet to
manage all of their Amazon EC2 instances running in both the public and private subnets. They have
only authorized the bastion-security-group with Microsoft Remote Desktop Protocol (RDP) access to
the application instance security groups, but the company wants to further limit administrative
access to all of the instances in the VPC. Which of the following Bastion deployment scenarios will
meet this requirement?- ADeploy a Windows Bastion host on the corporate network that has RDP access to all instances in
the VPC. - BDeploy a Windows Bastion host with an Elastic IP address in the public subnet and allow SSH
access to the bastion from anywhere. - CDeploy a Windows Bastion host with an Elastic IP address in the private subnet, and restrict RDP
access to the bastion from only the corporate public IP addresses. - DDeploy a Windows Bastion host with an auto-assigned Public IP address in the public subnet, and
allow RDP access to the bastion from only the corporate public IP addresses.
- ADeploy a Windows Bastion host on the corporate network that has RDP access to all instances in
43Which of the following actions can Cloud Formation trigger when launching Amazon Linux
EC2 instance?- ADownload and install software
- BAttach the instance to an Elastic Map Reduce job flow
- CChange the password for the root user
- DCreate custom files on the file system
- EChange the EC2 instance metadata
44To meet compliance standards, a company must have encrypted archival data storage. Data
will be accessed infrequently, with lead times when in advance of when archived data must be
recovered. The company requires that the storage be secure, durable and provided at the lowest
price per 1TB of data stored.
What type of stooge should be used?- AAmazon S3
- BAmazon EBS
- CAmazon Glacier
- DAmazon EFS
45An interactive, dynamic website runs on Amazon EC2 instances in a single subnet behind an
ELB Classic Load Balancer.
Which design changes will make the site more highly available?- AMove some Amazon EC2 instances to a subnet in a different way.
- BMove the website to Amazon S3.
- CChange the ELB to an Application Load Balancer.
- DMove some Amazon EC2 instances to a subnet in the same Availability Zone.
46You have a distributed application that periodically processes large volumes of data across
multiple Amazon EC2 Instances. The application is designed to recover gracefully from Amazon EC2
instance failures. You are required to accomplish this task in the most cost-effective way. Which of
the following will meet your requirements?- ASpot Instances
- BReserved instances
- CDedicated instances
- DOn-Demand instances
47A customer has a single 3-TB volume on-premises that is used to hold a large repository of
images and print layout files. This repository is growing at 500 GB a year and must be presented as a
single logical volume. The customers is becoming. Which AWS Storage Gateway configuration meets
the customer requirements?- AGateway-Cached volumes with snapshots scheduled to Amazon S3
- BGateway-stored volumes with snapshots scheduled to Amazon S3
- CGateway-Virtual Tape library with snapshots to Amazon S3
- DGateway-Virtual tape library with snapshots to Amazon Glacier
48Which set of Amazon 53 features helps to prevent and recover from accidental data loss?
- AObject lifecycle and service access logging
- BObject versioning and Multi-factor authentication
- CAccess controls and server-side encryption
- DWebsite hosting and Amazon S3 policies
49A company wants to improve latency by hosting images within a public Amazon S3 bucket
fronted by an Amazon CloudFront distribution. The company wants to restrict access to the S3 bucket
to include the CloudFront distribution only, while also allowing CloudFront to continue proper
functionality.
What should be done after making the bucket private to restrict access with the LEAST operational
overhead?- ACreate a CloudFront origin access identity and create a security group that allows access from
CloudFront. - BCreate a CloudFront origin access identity and update the bucket policy to grant access to it.
- CCreate a bucket policy restricting all access to the bucket to include CloudFront IPs only.
- DEnable the CloudFront option to restrict viewer access and update the bucket policy to allow the
distribution.
- ACreate a CloudFront origin access identity and create a security group that allows access from
50An Autoscaling group spans 3 AZs and currently has 4 running EC2 instances. When Auto
scaling needs to terminate an EC2 instance, by default, Auto scaling will:- ASend an SNS notification, if configured to do so
- BAllow at least five minutes for Windows/Linux shutdown scripts to complete, before terminating
the instance - CRandomly select one of the 3 AZs, and then terminate an instance in that AZ
- DTerminate an instance in the AZ which currently has 2 running EC2 instances
- ETerminate the instance with the least active network connections if multiple instances meet this
criterion, one will be randomly selected
51A company is running a series of national TV campaigns. These 30 second advertisements
will introduce sudden traffic peaks targeted at a Node .js application. The company experts traffic to
increase from five requests each minute to more than 5,000 requests each minutes.
Which AWS service should a Solution Architecture use to ensure traffic surges can be handled?- AAWS Lambda
- BAmazon ElasticCache
- CSize EC2 instance to handle peak load
- DAn Auto Scaling group for EC2 instance.
52A Solutions Architect must design a solution that encrypts data in Amazon S3 Corporate
policy mandates encryption keys be generated and managed on premises. Which solution should the
Architect use to meet the security requirements?- AAWS CloudHSM
- BSSE-KMS. Server-side encryption with AWS KMS managed keys
- CSSE-S3 Server-side encryption with Amazon-managed master key
- DSSE-C Server-side encryption with customer-provided encryption keys
53A Solutions Architect is designing a solution that will include a database in Amazon RDS.
Corporate security policy mandates that the database, its logs, and its backups are all encrypted.
Which is the MOST efficient option to fulfill the security policy using Amazon RDS?- ALaunch an Amazon RDS instance with encryption enabled Enable encryption for logs and backups
- BLaunch an Amazon RDS instance Enable encryption for the database, logs, and backups
- CLaunch an Amazon RDS instance with encryption enabled Logs and backups are automatically
encrypted - DLaunch an Amazon RDS instance. Enable encryption for backups Encrypt logs with a database-
engine feature
54Which requirements must be met in order for a Solutions Architect to specify that an
Amazon EC2 instance should stop rather than terminate when its Spot Instance is interrupted?
(Choose two.)- AThe Spot Instance request type must be one-time.
- BThe Spot Instance request type must be persistent.
- CThe root volume must be an Amazon EBS volume.
- DThe root volume must be an instance store volume.
- EThe launch configuration is changed.
55A Solutions Architect is designing a solution that retains traffic information between
network interfaces. The traffic information will then be monitored for anomalies by an InfoSec team using Amazon CloudWatch.
What approach should the Architect take?- ASave all inbound requests to Amazon DynamoDB
- BMaintain traffic history on each Amazon EC2 instance
- CEnable Amazon VPC Flow Logs
- DSave all inbound requests to Amazon S3
56Application servers currently deployed in a private subnet require the ability to integrate
with a third-party service accessible through the Internet.
Which changes are required to provide outbound Internet connectivity In the VPC without providing
inbound Internet connectivity to the application servers?- ACreate a NAT Gateway without attaching an Internet Gateway to the VPC
- BCreate a NAT Gateway and attach an Internet Gateway to the VPC.
- CAttach an Internet Gateway to the VPC without creating a NAT Gateway.
- DAttach a Virtual Private Gateway to the VPC and create a NAT Gateway.
57An instance is launched into a VPC subnet with the network ACL configures to allow all
inbound traffic and deny all outbound traffic. The instance's security group is configured to allow SSH
from any IP address and deny all outbound traffic. What changes need to be made to allow SSH
access to instance?- AThe outbound security group needs to be modified to allow outbound traffic
- BBoth the outbound security group and outbound network ACL need to be modified to allow
outbound traffic - CThe outbound network ACL needs to be modified to allow outbound traffic
- DNothing, it can be accessed from any IP address using SSH
58A Company requires scalable shared storage to be accessed from hundreds of Linux-based
Amazon EC2 instances in a single region.
Which option provides the greatest levels of availability and performance?- AMount an Amazon S3 bucket as a volume by using third-party tools like s3fs
- BImplement a file gateway in the same region, and present it to the EC2 instances
- CUse Amazon EFS and mount it from different Availability Zones
- DDesign an LVM-based NFS server, and add more Provisioned IOPS volumes to it when more space
is needed
59A Solutions Architect is designing a log-processing solution that requires storage that
supports up to 500 MB/s throughput. The data is sequentially accessed by an Amazon EC2 instance.
Which Amazon storage type satisfies these requirements?- AEBS Provisioned IOPS SSD (io1)
- BEBS General Purpose SSD (gp2)
- CEBS Throughput Optimized HDD (st1)
- DEBS Cold HDD (sc1)
60A Solution Architect is designing a disaster recovery solution for a 5 TB Amazon Redshift
cluster. The recovery site must be at least 500 miles (805 kilometers) from the live site.
How should the Architect meet these requirements?- AUse AWS CloudFormation to deploy the cluster in a second region.
- BTake a snapshot of the cluster and copy it to another Availability Zone.
- CModify the Redshift cluster to span two regions.
- DEnable cross-region snapshots to a different region.
61A Lambda function must execute a query against an Amazon RDS database in a private
subnet. Which steps are required to allow the Lambda function to access the Amazon RDS database
(Select TWO.)- ACreate a VPC Endpoint for Amazon RDS
- BCreate the Lambda function within the Amazon RDS VPC.
- CChange the ingress rules of Lambda security group, allowing the Amazon RDS security group
- DChange the ingress rules of the Amazon RDS security group, allowing the Lambda security group
- EAdd an Internet Gateway (IGW) to the VPC route the private subnet to the IGW
62An instance is launched into a VPC subnet with the network ACL configured to allow all
inbound traffic and deny all outbound traffic. The instance's security group is configured to allow SSH
from any IP address and deny all outbound traffic. What changes need to be made to allow SSH
access to the instance?- AThe outbound security group needs to be modified to allow outbound traffic.
- BThe outbound network ACL needs to be modified to allow outbound traffic.
- CNothing, it can be accessed from any IP address using SSH.
- DBoth the outbound security group and outbound network ACL need to be modified to allow
outbound traffic.
63A company has an Amazon RDS-managed online transaction processing system that has veryheavy read and write. The Solutions Architect notices throughput issues with the system.
How can the responsiveness of the primary database be improved?- AUse asynchronous replication for standby to maximize throughput during peak demand.
- BOffload SELECT queries that can tolerate stale data to READ replica
- COffload SELECT and UPDATE queries to READ replica.
- DOffload SELECT query that needs the most current data to READ replica.
64A customer has an application that is used by enterprise customers outside of AWS. Some of
these customers use legacy firewall that cannot whitelist by DNS name, but can whitelist based only
on IP address. The application is currently deployed in two Availability zones, with the one EC2
instance in each that has Elastic IP addresses. The customers wants to whitelist only two IP
addresses, but the two existing EC2 instance cannot sustain the amount of traffic.
What can a Solution Architect do to support the customer and allow for more capacity? (Select TWO)- ACreate a Network Load Balancer with an interface in each subnet, and assign a static IP address to
each subnet - BCreate additional EC2 instances and put them on standby. Remap an Elastic IP address to a
standby instance in the event of a failure - CUse Amazon Route 53 with a weighted, round-robin routing policy across the Elastic IP addresses
to resolve one at a time - DAdd additional EC2 instances with Elastic IP addresses, and register them with Amazon Route 53
- ESwitch the two existing EC2 instances for an Auto Scaling group, and register them with the
Network Load Balancer
- ACreate a Network Load Balancer with an interface in each subnet, and assign a static IP address to
65Developers are creating a new online transaction processing (OLTP) application for a small
database that is very read-write intensive. A single table in the database is updated continuously
throughout the day, and the developers want to ensure that the database performance is consistent.
Which Amazon EBS storage option will achieve the MOST consistent performance to help maintain
application performance?- AProvisioned IOPS SSD
- BGeneral Purpose SSD
- CCold HDD
- DThroughput Optimized HDD
66You manually launch a NAT AMI in a public subnet. The network in properly configured.
Security groups and network access control lists are properly configured. Instances in a private
subnet can access the NAT. The NAT can access the internet. However, private instances cannot
access the internet. What additional step is required to allow access from the private instances?- AEnable Source/Destination check on the private instances
- BEnable Source/Destination check on the NAT instance
- CDisable Source/Destination check on the private instance
- DDisable Source/Destination check on the NAT instance
67A Solutions Architect is designing a VPC. Instances in a private subnet must be able to
establish IPv6 traffic to the Internet. The design must scale automatically and not incur any additional
cost. This can be accomplished with:- Aan egress-only internet gateway
- Ba NAT gateway
- Ca custom NAT instance
- Da VPC endpoint
68How can an EBS volume that is currently attached to an EC2 instance be migrated from one
Availability Zone to another?- ASimply create a new volume in the other AZ and specify the original volume as the source
- BDetach the volume and attach it to another EC2 instance in the other AZ
- CCreate a snapshot of the volume, and create a new volume from the snapshot in the other AZ
- DDetach the volume, then use the ec2-migrate-volume command to move it to another AZ
69You have a content management system running on an Amazon EC2 instance that is
approaching 100% CPU utilization. Which option will reduce load on the Amazon EC2 instance?- ACreate a load balancer, and register the Amazon EC2 instance with it
- BCreate a CloudFront distribution, and configure the Amazon EC2 instance as the origin
- CCreate an Auto Scaling group from the instance using the CreateAutoScalingGroup action
- DCreate a launch configuration from the instance using the CreateLaunchConfiguration action
70You are designing a web application that stores static assets in an Amazon Simple Storage
Service (S3) bucket. You expect this bucket to immediately receive over 150 PUT requests per second.
What should you do to ensure optimal performance?- AUse multi-part upload
- BAdd a random prefix to the key names.
- CAmazon S3 will automatically manage performance at this scale.
- DUse a predictable naming scheme, such as sequential numbers or date time sequences, in the key
names
71How can you secure data at rest on an EBS volume?
- AAttach the volume to an instance using EC2's SSL interface.
- BWrite the data randomly instead of sequentially.
- CEncrypt the volume using the S3 server-side encryption service.
- DCreate an IAM policy that restricts read and write access to the volume.
- EUse an encrypted file system on top of the EBS volume.
72A Solutions Architect is designing a solution to send Amazon CloudWatch Alarm
notifications to a group of users on a smartphone mobile application.
What are the key steps to this solution? (Choose two.)- AConfigure the CloudWatch Alarm to send the notification to an Amazon SNS topic whenever there
is an alarm. - BConfigure the CloudWatch Alarm to send the notification to a mobile phone number whenever
there is an alarm. - CConfigure the CloudWatch Alarm to send the notification to the email addresses whenever there is
an alarm. - DCreate the platform endpoints for mobile devices and subscribe the SNS topic with platform
endpoints. - ESubscribe the SNS topic with an Amazon SQL queue, and poll the messages continuously from the
queue.
Use each mobile platform's libraries to send the message to the mobile application
- AConfigure the CloudWatch Alarm to send the notification to an Amazon SNS topic whenever there
73A company runs a legacy application with a single-tier architecture on an Amazon EC2
Instance. Disk I/O is low, with occasional small spikes during business hours. The company requires
the instance to be stopped from 8 PM to 8 AM daily.
Which storage option is MOST appropriate for this workload?- AAmazon EC2 instance storage
- BAmazon EBS General Purpose SSD (gp2) storage
- CAmazon S3
- DAmazon EBS Provision IOPS SSD (io1) storage
74A user is designing a new service that receives location updates from 3.600 rental cars every
hour. The cars upload their location to an Amazon S3 bucket. Each location must be checked tor
distance from the original rental location. Which services will process the updates and automatically
scale?- AAmazon EC2 and Amazon EBS
- BAmazon Kinesis Firehouse and Amazon S3
- CAmazon ECS and Amazon RDS
- DAmazon S3 events and AWS Lambda
75You're building an API backend available at services.yourcompany.com. The API is
implemented with API Gateway and Lambda. You successfully tested the API using curd. You
implemented Javascript to call the API from a webpage on your corporate website,
www.yourcompany.com. When you access that page in your browser, you get the following error:
"The same origin policy disallows reading he remote resource" How can you allow your corporate
webpages to invoke the API?- ADisable CORS in the API gateway
- BEnable CORS in the Javascript frontend
- CDisable CORS in the Javascript frontend
- DEnable CORS in the API gateway
76An application generates audit logs of operational activities Compliance requirements
mandate that the application retain the logs for 5 years How can these requirements be met?- ASave the logs in an Amazon S3 bucket and enable Multi-Factor Authentication Delete (MFA Delete)
on the bucket - BSave the logs in an Amazon EFS volume and use Network File System version 4 (NFSv4) locking
with the volume - CSave the logs in an Amazon Glacier vault and use the Vault Lock feature.
- DSave the logs in an Amazon EBS volume and lake monthly snapshots
- ASave the logs in an Amazon S3 bucket and enable Multi-Factor Authentication Delete (MFA Delete)
77A company has two different types of reporting needs on their 200-GB data warehouse:
Data scientists run a small number of concurrent ad hoc SQL queries that can take several minutes
each to run.
Display screens throughout the company run many fast SQL queries to populate dashboards.
Which design would meet these requirements with the LEAST cost?- AReplicate relevant data between Amazon Redshift and Amazon DynamoDB. Data scientists use
Redshift. Dashboards use DynamoDB. - BConfigure auto-replication between Amazon Redshift and Amazon RDS. Data scientists use
Redshift. Dashboards use RDS. - CUse Amazon Redshift for both requirements, with separate query queues configured in workload
management. - DUse Amazon Redshift for Data Scientists. Run automated dashboard queries against Redshift and
store the results in Amazon ElastiCache. Dashboards query ElastiCache.
- AReplicate relevant data between Amazon Redshift and Amazon DynamoDB. Data scientists use
78A company's website receives 50.000 requests each second, and the company wants 10 use
multiple applications to analyze the navigation patterns of the users on their website so that the
experience can Be personalized.
What can a Solutions Architect use to collect page clicks for the website and process them
sequentially for each user?- AAmazon Kinesis Stream
- BAmazon SQS standard queue
- CAmazon SQS FIFO queue
- DAWS CloudTrail trail
79You have a load balancer configured for VPC, and all back-end Amazon EC2 instances are in service.
However, your web browser times out when connecting to the load balancer's DNS name. Which
options are probable causes of this behavior? Choose 2 answers- AThe load balancer was not configured to use a public subnet with an Internet gateway configured
- BThe security groups or network ACLs are not properly configured for web traffic
- CThe VPC does not have a VGW configured
- DThe Amazon EC2 instances do not have a dynamically allocated private IP address
- EThe load balancer is not configured in a private subnet with a NAT instance
80A Solutions Architect is developing a solution for sharing files in an organization. The
solution must allow multiple users to access the storage service at once from different virtual
machines and scale automatically. It must also support file-level locking.
Which storage service meets the requirements of this use case?- AAmazon S3
- BAmazon EFS
- CAmazon EBS
- DCached Volumes
81A Solutions Architect is building a multi-tier website. The web servers will be in a public
subnet, and the database servers will be in a private subnet. Only the web servers can be accessed
from the Internet. The database servers must have Internet access for software updates.
Which solution meets the requirements?- AAssign Elastic IP addresses to the database instances.
- BAllow Internet traffic on the private subnet through the network ACL.
- CUse a NAT Gateway.
- DUse an egress-only Internet Gateway.
82Which of the following are valid statements about Amazon S3? Choose 2 answers
- AS3 provides read-after-write consistency for any type of PUT or DELETE.
- BConsistency is not guaranteed for any type of PUT or DELETE.
- CA successful response to a PUT request only occurs when a complete object is saved.
- DPartially saved objects are immediately readable with a GET after an overwrite PUT.
- ES3 provides eventual consistency for overwrite PUTS and DELETES.
83A company has an Amazon RDS database backing its production website. The Sales team
needs to run queries against the database to track training program effectiveness. Queries against
the production database cannot impact performance, and the solution must be easy to maintain.
How can these requirements be met?- AUse an Amazon Redshift database. Copy the product database into Redshift and allow the team to
query it. - BUse an Amazon RDS read replica of the production database and allow the team to query against
it. - CUse multiple Amazon EC2 instances running replicas of the production database, placed behind a
load balancer. - DUse an Amazon DynamoDB table to store a copy of the data.
- AUse an Amazon Redshift database. Copy the product database into Redshift and allow the team to
84You have an Amazon EC2 instance that belongs to two security groups. The first security
group has a rule that allows ingress traffic to TCP port 80 from IP address 206.251.8.21 and the
second security group has a rule that allows ingress traffic to TCP ports 80 and 443 from everywhere.
Which traffic is allowed to the Amazon EC2 instance?- AOnly ingress traffic to TCP port 80 from everywhere
- BOnly ingress traffic to TCP port 80 from 206.251.8.21
- COnly ingress traffic to TCP ports 80 and 443 from everywhere
- DOnly ingress traffic to TCP ports 80 and 443 from 206.251.8.21
85Which of the following categories are available from Amazon elastic compute cloud instance
metadata ? Choose two answers- AInstance ID
- BElastic Load Balancing health status
- CAuto Scaling launch configuration
- DBucket device mapping
- EBucket ID
86What is a placement group?
- AA collection of Auto Scaling groups in the same region
- BA feature that enables EC2 instances to interact with each other via high bandwidth, low latency
connections - CA collection of authorized CloudFront edge locations for a distribution
- DA collection of Elastic Load Balancers in the same Region or Availability Zone
87You have been asked to design a fault-tolerant and scalable web application across three
availability zones.
The presentation logic will reside on web servers behind an ELB classic load balancer, and the
application logic will reside on a set of app servers behind a second load balancer. How should you
use auto scaling groups?- ADeploy two Auto Scaling groups: one for the web servers in all Availability zones and one for the
app servers in all Availability zones - BDeploy three auto scaling groups: one for each Availability zone that includes both web and app
servers - CDeploy six auto scaling groups: a web server group in each Availability zone and an app server
group in each availability zone - DDeploy one auto scaling group that includes al the web and app servers across all availability zones
- ADeploy two Auto Scaling groups: one for the web servers in all Availability zones and one for the
88A social networking portal experiences latency and throughput issues due to an increased
number of users.
Application servers use very large datasets from an Amazon RDS database, which creates a
performance bottleneck on the database.
Which AWS service should be used to improve performance?- AAuto Scaling
- BAmazon SQS
- CAmazon ElastiCache
- DELB Application Load Balancer
89Which of the following approaches provides the lowest cost for Amazon Elastic Block Store
snapshots while giving you the ability to fully restore data?- AMaintain a single snapshot: the latest snapshot is both incremental and complete
- BMaintain the most current snapshots, archive the original and incremental to Amazon Glacier
- CMaintain a volume snapshot: subsequent snapshots will overwrite one another
- DMaintain two snapshots: the original snapshot and the latest incremental snapshot
90A retail company has sensors placed in its physical retail stores. The sensors send messages
over HTTP when customers interact with in-store product displays. A Solutions Architect needs to
implement a system for processing those sensor messages; the results must be available for the Data
Analysis team.
Which architecture should be used to meet these requirements?- AImplement an Amazon API Gateway to server as the HTTP endpoint. Have the API Gateway trigger an AWS Lambda function to process the messages, and save the results to an Amazon DynamoDB
table. - BCreate an Amazon EC2 instance to server as the HTTP endpoint and to process the messages. Save
the results to Amazon S3 for the Data Analysis team to download. - CUse Amazon Route 53 to direct incoming sensor messages to a Lambda function to process the
message and save the results to a Amazon DynamoDB table. - DUse AWS Direct Connect to connect sensors to DynamoDB so that data can be written directly to a
DynamoDB table where it can be accessed by the Data Analysis team.
- AImplement an Amazon API Gateway to server as the HTTP endpoint. Have the API Gateway trigger an AWS Lambda function to process the messages, and save the results to an Amazon DynamoDB
91A customer needs corporate IT governance and cost oversight of all AWS resources
consumed by its divisions.
The divisions wants to maintain administrative control of the discrete AWS resources they consume
and keep those resources separate from the resources of other divisions. Which of the following options, when used together, will support the autonomy/control of divisions while enabling
corporate IT to maintain governance and oversight? Choose 2 answers- AEnable IAM cross-account access for all corporate IT administrators in each child account.
- BCreate separate VPCs for each division within the corporate IT AWS account
- CUse AWS Consolidated Billing and disable AWS root account access for the child accounts
- DUse AWS Consolidated billing to link the divisions accounts to a parent corporate account
- EWrite all child AWS CloudTrail and Amazon CloudWatch logs to each child account's Amazon S3 log
bucket
92You are migrating a MySQL database to Amazon RDS. You have allocated enough block
storage for the initial migration. You expect data storage requirements to grow slowly over time:
How can you expand the storage capacity of your Amazon RDS database instance in the future?- AAllocate additional storage as needed. Plan for a brief database outage during the allocation.
- BMigrate the data base to a larger instance type as needed. Plan for a period of reduced
performance during the migration - CMigrate the database to a larger instance type as needed. Plan for a brief database outage during
the migration - DAllocate additional storage as needed. Plan for a period of reduced performance during the
allocation
93A company is migrating its data center to AWS. As part of this migration, there is a three-tier
web application that has strict data-at-rest encryption requirements. The customer deploys this
application on Amazon EC2 using Amazon EBS, and now must provide encryption at-rest.
How can this requirement be met without changing the application?- AUse AWS Key Management Service and move the encrypted data to Amazon S3.
- BUse an application-specific encryption API with AWS server-side encryption
- CUse encrypted EBS storage volumes with AWS-managed keys
- DUse third-party tools to encrypt the EBS data volumes with Key Management Service Bring Your
Own Keys.
94A company is using Amazon S3 as its local repository for weekly analysis reports. One of the
company-wide requirements is to secure data at rest using encryption. The company chose Amazon
S3 server-wide encryption. The company wants to know how the object is decrypted when a GET
request is issued.
Which of the following answers this question?- AThe user needs to place a PUT request to decrypt the object
- BThe user needs to decrypt the object using a private key
- CAmazon S3 manages encryption and decryption automatically
- DAmazon S3 provides a server-side key for decrypting the object
95Within a VPC, you need to allow a wide range of ports, and block several non-contiguous
ports within the range. Which option will allow you to do this ?- AUsing a network ACL, place a DENY rule for ports to be blocked ahead of the ALLOW rule for the
wide range of ports - BUsing a network ACL, place a DENY rule for ports to be blocked after the ALLOW rule for the wide
range of ports - CUsing a security group, place a DENY rule for ports to be blocked ahead of the ARROW rule for the
wide range of ports - DUsing a security group, place a DENY rule for ports to be blocked after the ALLOW rule for the
wide range of ports
- AUsing a network ACL, place a DENY rule for ports to be blocked ahead of the ALLOW rule for the
96An organization regularly bocks up their application data. The application backups are
required to be stored on Amazon S3 for a certain amount of time, and need to be accessed instantly
in the event of a disaster recovery.
Which of the following Amazon S3 storage classes would be the MOST cost-effective option to meet
the needs of this scenario?- AGlacier Storage Class
- BStandard Storage Class
- CStandard - Infrequent Access (IA)
- DReduced Redundancy Class (RRS)
97A user is testing a new service that receives location updates from 3,600 rental cars every
hour.
Which service will collect data and automatically scale to accommodate production workload?- AAmazon EC2
- BAmazon Kinesis Firehose
- CAmazon EBS
- DAmazon API Gateway
98You have an EC2 Security Group with several running EC2 instances. You change the Security
Group rules to allow inbound traffic on a new port and protocol, and launch several new instances in
the same Security Group. The new rules apply:- AImmediately to all instances in the security group.
- BImmediately to the new instances only.
- CImmediately to the new instances, but old instances must be stopped and restarted before the
new rules apply. - DTo all instances, but it may take several minutes for old instances to see the changes.
99What would happen to an RDS (Relational Database Service) multiAvailability Zone
deployment if the primary DB instance fails?- AThe IP of the primary DB instance is switched to the standby DB instance
- BA new DB instance is created in the standby availability zone
- CThe canonical name record (CNAME) is changed from primary to standby
- DThe RDS DB instance reboots
100A company's development team plans to create an Amazon S3 bucket that contains millions
of images. The team wants to maximize the read performance of Amazon S3.
Which naming scheme should the company use?- AAdd a date as the prefix.
- BAdd a sequential id as the suffix.
- CAdd a hexadecimal hash as the suffix.
- DAdd a hexadecimal hash as the prefix.
Información
- Descripción
- aw Test sobre a3, creado por Antonio M el 27/05/2019.
- Autor
- Antonio M
- Idioma
- Español
- Visitas
- 1
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test