OAFBF

Question 1

NO.1 A company wants to follow its website on AWS using serverless architecture design patterns for global customers. The company has outlined its requirements as follow:
* The website should be responsive.
* The website should offer minimal latency.
* The website should be highly available.
* Users should be able to authenticate through social identity providers such as Google, Facebook, and Amazon.
* There should be baseline DDoS protections for spikes in traffic.
How can the design requirements be met?

Accepted Answer

Use Amazon CloudFront with Amazon S3 for hosting static web resources. Use Amazon Cognito to provide user management and authentication functions. Use Amazon API Gateway with AWS Lambda to build an API.

Answer

Use Amazon CloudFront with Amazon ECS for hosting the website. Use AWS Secrets Manager to provide user management and authentication functions. Use ECS Docker containers to build an API.

Answer

Use Amazon Route 53 latency routing with an Application Load Balancer and AWS Fargate in different regions for hosting the website. Use Amazon Cognito to provide user management and authentication functions. Use Amazon EKS containers to build an APL.

Answer

Use AWS Direct Connect with Amazon CloudFront and Amazon S3 for hosting static web resources.
Use Amazon Cognito to provide user management and authentication functions. Use AWS Lambda to build an API.

Question 2

NO.2 A company is migrating a subset of its application APIs from Amazon EC2 instances to run on a serverless infrastructure. The company has set up Amazon API Gateway, AWS Lambda, and Amazon DynamoDB for the new application. The primary responsibility of the Lambda function is to obtain data from a third-party Software as a Service (SaaS) provider. For consistency, the Lambda function is attached to the same virtual private cloud (VPC) as the original EC2 instances.
Test users report an inability to use this newly moved functionality, and the company is receiving 5xx errors from API Gateway. Monitoring reports from the SaaS provider shows that the requests never made it to its systems. The company notices that Amazon CloudWatch Logs are being generated by the Lambda functions. When the same functionality is tested against the EC2 systems, it works as expected.
What is causing the issue?

Accepted Answer

Lambda is in a subnet that does not have a NAT gateway attached to it to connect to the SaaS provider.

Answer

The end-user application is misconfigured to continue using the endpoint backed by EC2 instances.

Answer

The throttle limit set on API Gateway is too low and the requests are not making their way
through.

Answer

API Gateway does not have the necessary permissions to invoke Lambda.

Question 3

NO.3 A company recently completed a large-scale migration to AWS Development teams that support various business units have their own accounts in AWS Organizations. A central cloud team is responsible for controlling which services and resources can be accessed, and for creating operational strategies for all teams with the company. Some teams are approaching their account service quotas. The cloud team needs to create an automated and operationally efficient solution to proactively monitor service quotas. Monitoring should account every 15 minutes and send alerts when a team exceeds 80% utilization.
Which solution will meet these requirements?

Accepted Answer

Create an Amazon CloudWatch alarm that triggers an AWS Lambada function to call the Amazon CloudWatch GettingSightRuleReport. API to retrieve the most current utilization and service limit data if the current utilization is above 80%, publish an Amazon Simple Email Service (Amazon SES) notification to alert the cloud team. Create AWS CloudFormation SrackSets that deploy the necessary
resource to all Organizations accounts.

Answer

Create a scheduled AWS Config rule to trigger an AWS Lambada function to call the GetServiceQuota API. If any service utilization is above 80%, publish a message to an Amazon Simple Notification Service (Amazon SNS) topic to alert the cloud team. Create an AWS CloudFormation template and deploy the necessary resources to each account.

Answer

Create an Amazon EvenBridge (Amazon CloudWatch Events) rule that triggers an AWS Lambada function to refresh the AWS Trusted Advisor service limit checks and retrieve the most current utilization and service limit data. If the current utilization is above 80% puclish a message to an Amazon Simple Notification Service (Amazon SNS) topic to alert the cloud team. Create AWS CloudFormation StackSets that deploy the necessary resources to all Organizations accounts.

Answer

Create an Amazon EvenBridge (Amazon CloudWatch Events) rule that triggers an AWS Lambda function to refresh the AWS Trusted Advisor service limit checks and retrieve the most current utilization and service limit data. IF the current utilization is above 80% use Amazon Pinpoint to send an alert to the cloud team. Create an AWS CloudFormation template and deploy the necessary resources to each account.

Question 4

NO.4 A company collects a steady stream of 10 million data records from 100,000 sources each day. These records are written to an Amazon RDS MySQL DB. A query must produce the daily average of a data source over the past 30 days. There are twice as many reads as writes. Queries to the collected data are for one source ID at a time.
How can the Solutions Architect improve the reliability and cost effectiveness of this solution?

Accepted Answer

Use Amazon DynamoDB with the source ID as the partition key and the timestamp as the sort key. Use a Time to Live (TTL) to delete data after 30 days.

Answer

Use Amazon Aurora with MySQL in a Multi-AZ mode. Use four additional read replicas.

Answer

Use Amazon DynamoDB with the source ID as the partition key. Use a different table each day.

Answer

Ingest data into Amazon Kinesis using a retention period of 30 days. Use AWS Lambda to write data records to Amazon ElastiCache for read access.

Question 5

NO.5 A government agency is building a forms submission portal using AWS to allow citizen to submit and retrieve sensitive documents. The solution was built using serverless architecture, with the front-end code developed using HTML and JavaScript and the backend architecture using Amazon API Gateway and Amazon S3.
The portal must meet the following security requirements:
* Requests to the backend infrastructure should be allowed only if they originate from a specific country.
* Requests to the backend infrastructure should prevent brute attacks from individual IP addresses by not allowing more than 3000 requests per minutes for 10 requests per seconds for each IP address.
* All access attempts to the backend infrastructure must be logged.
Which steps should a solution architect take to meet these requirements? (Select Two)

Accepted Answer

Create an AWS WAF web ACL with a custom condition that allows access attempts from the authorized country only, and a rate-based rule with a rate-based rule with rate limit 3000 requests per 5 minutes. Then associate the web ACL with the API Gateway API.

Accepted Answer

Configure the AWS WAF web ACL to an Amazon CloudWatch Logs group. Configure API Gateway to log to an Amazon Cloudwatch Logs group.

Answer

Configure the API Gateway API with a custom rule condition that allow APIs to be called from the authorized country only. Then enable default method throttling, setting the rate limit in 10 requests per seconds.

Answer

Configure Amazon Cloud with a geographical restriction that allows access attempts from the authorized country only, and a rate-based rule with a rate limit of 3000 requests per 5 minutes. Then Add the API Gateway API as a custom origin.

Answer

Configure the AWS WAF web ACL to log to an Amazon Kinesis Data Firehose delivery with Amazon Elasticsearch Service (Amazon ES) as the destination. Configure API Gateway to log to an Amazon CloudWatch Logs group.

Question 6

NO.6 A company's main intranet page has experienced degraded response times as its user base has increased although there are no reports of users seeing error pages. The application uses Amazon DynamoDB in read-only mode.
Amazon DynamoDB latency metrics for successful requests have been in a steady state even during times when users have reported degradation The Development team has correlated the issue to ProvisionedThrough put Exceeded exceptions in the application logs when doing Scan and read operations The team also identified an access pattern of steady spikes of read activity on a distributed set of individual data items The Chief Technology Officer wants to improve the user experience Which solutions will meet these requirements with the LEAST amount of changes to the application? (Select TWO)

Accepted Answer

Enable DynamoDB auto scaling to manage the throughput capacity as table traffic increases Set the upper and lower limits to control costs and set a target utilization given the peak usage and how quickly the traffic changes.

Accepted Answer

Implement the DynamoDB Accelerator (DAX) client and provision a DAX cluster with the appropriate node types to sustain the application load. Tune the item and query cache configuration for an optimal user experience.

Answer

Change the data model of the DynamoDB tables to ensure that all Scan and read operations meet DynamoDB best practices of uniform data access, reaching the full request throughput provisioned for the DynamoDB tables.

Answer

Provision Amazon ElastiCache for Redis with cluster mode enabled The cluster should be provisioned with enough shards to spread the application load and provision at least one read replica node for each shard.

Answer

Remove error retries and exponential backoffs in the application code to handle throttling errors.

Question 7

NO.7 A company has asked a Solutions Architect to design a secure content management solution that can be accessed by API calls by external customer applications. The company requires that a customer administrator must be able to submit an API call and roll back changes to existing files sent to the content management solution, as needed.
What is the MOST secure deployment design that meets all solution requirements?

Accepted Answer

Use Amazon S3 for object storage with versioning and bucket access logging enabled, and an IAM role and access policy for each customer application. Encrypt objects using SSE-KMS. Develop the content management application to use a separate AWS KMS key for each customer.

Answer

Use Amazon WorkDocs for object storage. Leverage WorkDocs encryption, user access management, and version control. Use AWS CloudTrail to log all SDK actions and create reports of hourly access by using the Amazon CloudWatch dashboard. Enable a revert function in the SDK based on a static Amazon S3 webpage that shows the output of the CloudWatch dashboard.

Answer

Use Amazon EFS for object storage, using encryption at rest for the Amazon EFS volume and a customer managed key stored in AWS KMS. Use IAM roles and Amazon EFS access policies to specify separate encryption keys for each customer application. Deploy the content management application to store all new versions as new files in Amazon EFS and use a control API to revert a specific file to a previous version.

Answer

Use Amazon S3 for object storage with versioning and enable S3 bucket access logging. Use an IAM role and access policy for each customer application. Encrypt objects using client-side encryption, and distribute an encryption key to all customers when accessing the content management application.

Question 8

NO.8 A company is running a large application on-premises. Its technology stack consists of Microsoft .NET for the web server platform and Apache Cassandra for the database. The company wants to migrate the application to AWS to improve service reliability. The IT team also wants to reduce the time it spends on capacity management and maintenance of this infrastructure. The Development team is willing and available to make code changes to support the migration.
Which design is the LEAST complex to manage after the migration?

Accepted Answer

Migrate the web servers to an AWS Elastic Beanstalk environment that is running the .NET platform in a Multi-AZ Auto Scaling configuration. Migrate the existing Cassandra database to Amazon DynamoDB.

Answer

Migrate the web servers to Amazon EC2 instances in an Auto Scaling group that is running .NET. Migrate the existing Cassandra database to Amazon Aurora with multiple read replicas, and run both in a Multi-AZ mode.

Answer

Migrate the web servers to an AWS Elastic Beanstalk environment that is running the .NET platform in a Multi-AZ Auto Scaling configuration. Migrate the Cassandra database to Amazon EC2 instances that are running in a Multi-AZ configuration.

Answer

Migrate the web servers to Amazon EC2 instances in an Auto Scaling group that is running .NET. Migrate the existing Cassandra database to Amazon DynamoDB.

Question 9

NO.9 A Solutions Architect must design a highly available, stateless, REST service. The service will require multiple persistent storage layers for service object meta information and the delivery of content. Each request needs to be authenticated and securely processed. There is a requirement to keep costs as low as possible?
How can these requirements be met?

Accepted Answer

Set up Amazon API Gateway and create the required API resources and methods. Use an Amazon Cognito user pool to control access to the API. Configure the methods to use AWS Lambda proxy integrations, and process each resource with a unique AWS Lambda function. Store request meta information in DynamoDB with Auto Scaling and static content in a secured S3 bucket. Generate presigned URLs when returning references to content stored in Amazon S3.

Answer

Use AWS Fargate to host a container that runs a self-contained REST service. Set up an Amazon ECS service that is fronted by an Application Load Balancer (ALB). Use a custom authenticator to control access to the API. Store request meta information in Amazon DynamoDB with Auto Scaling and static content in a secured S3 bucket. Make secure signed requests for Amazon S3 objects and proxy the data through the REST service interface.

Answer

Use AWS Fargate to host a container that runs a self-contained REST service. Set up an ECS service that is fronted by a cross-zone ALB. Use an Amazon Cognito user pool to control access to the API. Store request meta information in DynamoDB with Auto Scaling and static content in a secured S3 bucket. Generate presigned URLs when returning references to content stored in Amazon S3.

Answer

Set up Amazon API Gateway and create the required API resources and methods. Use an Amazon API Gateway custom authorizer to control access to the API. Configure the methods to use AWS Lambda custom integrations, and process each resource with a unique Lambda function. Store request meta information in an Amazon ElastiCache Multi-AZ cluster and static content in a secured S3 bucket. Generate presigned URLs when returning references to content stored in Amazon S3.

Question 10

NO.10 A company is hosting a three-tier web application in an on-premises environment Due to a recent surge in traffic that resulted in downtime and a significant financial impact, company management has ordered that the application be moved to AWS. The application is written in .NET and has a dependency on a MySQL database. A solutions architect must design a scalable and highly available solution to meet the demand of 200,000 daily users.
Which steps should the solutions architect take to design an appropriate solution?

Accepted Answer

Use AWS Elastic Beanstalk to create an automatically scaling web server environment that spans two separate Regions with an Application Load Balancer (ALB) in each Region. Create a Multi-AZdeployment of an Amazon Aurora MySQL DB cluster with a cross-Region read replica. Use AmazonRoute 53 with a geoproximrty routing policy to route traffic between the two Regions.

Answer

Use AWS Elastic Beanstalk to create a new application with a web server environment and an Amazon RDS MySQL Multi-AZ DB instance. The environment should launch a Network Load Balancer (NLB) in front of an Amazon EC2 Auto Scaling group in multiple Availability Zones. Use an Amazon Route 53 alias record to route traffic from the company's domain to the NLB.

Answer

Use AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon EC2 Auto Scaling group spanning three Availability Zones. The stack should launch a Multi-AZ deployment of an Amazon Aurora MySQL DB cluster with a Retain deletion policy. Use an Amazon Route 53 alias record to route traffic from the company's domain to the ALB.

Answer

Use AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in frontof an Amazon ECS cluster of Spot Instances spanning three Availability Zones. The stack should launchan Amazon RDS MySQL DB instance with a Snapshot deletion policy. Use an Amazon Route 53 aliasrecord to route traffic from the company's domain to the ALB.

Question 11

NO.352 A company runs an IoT platform on AWS. IoT sensors in various locations send data to the company's Node.js API servers on Amazon EC2 instances running behind an Application Load Balancer. The data is stored in an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume.
The number of sensors the company has deployed in the field has increased over time, and is expected to grow significantly. The API servers are consistently overloaded and RDS metrics show high write latency.
Which of the following steps together will resolve the issues permanently and enable growth as new sensors are provisioned, while keeping this platform cost-efficient? (Choose two)

Accepted Answer

Leverage Amazon Kinesis Data Streams and AWS Lambda to ingest and process the raw data.

Accepted Answer

Re-architect the database tier to use Amazon DynamoDB instead of an RDS MySQL DB instance.

Answer

Resize the MySQL General Purpose SSD storage to 6 TB to improve the volume's IOPS.

Answer

Re-architect the database tier to use Amazon Aurora instead of an RDS MySQL DB instance andadd read replicas.

Answer

Use AWS-X-Ray to analyze and debug application issues and add more API servers to match the load.

Question 12

NO.11 A large company recently experienced an unexpected increase in Amazon RDS and Amazon DynamoDB costs. The company needs to increase visibility into delays of AWS Billing and Cost Management. There are various accounts associated with AWS Organizations, including many development and production accounts.
There is no consistent tagging strategy across the organization, but there are guidelines in place that require all infrastructure to be deployed using AWS CloudFormation with consistent tagging Management requires cost center numbers and project ID numbers for all existing and future DynamoOB tables and RDS instances.
Which strategy should the solutions architect provide to meet these requirements?

Accepted Answer

Use an AWS Config rule to alert the finance team of untagged resources. Create a centralized AWS Lambda based solution to tag untagged RDS databases and DynamoOB resources every hour using a cross-account role.

Answer

Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID and allow 24 hours for lags to propagate to existing resources.

Answer

Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID Use SCPs to restrict resource creation that do not have the cost center and project ID on the resource.

Answer

Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to propagate to existing resources. Update existing federated roles to restrict privileges to provision resources that do not include the cost center and project ID on the resource.

Question 13

NO.12 A company hosts a large on-premises MySQL database at its mam office that supports an issue tracking system used by employees around the world. The company already uses AWS for some workloads and has created an Amazon Route 53 entry for the database endpoint that points to the on-premises database. 
Management is concerned about the database being a single point of failure and wants a solutions architect to migrate the database to AWS without any data loss or downtime Which set of actions should the solutions architect implement?

Accepted Answer

Create an Amazon Aurora DB cluster Use AWS Database Migration Service (AWS DMS) to do a full load with continuous replication from the on-premises database to Aurora. 
When the migration is complete update the Route 53 entry for the database to point to the Aurora cluster endpoint and shut down the on-premises database.

Answer

Create an Amazon Aurora DB cluster Use AWS Database Migration Service (AWS DMS) to do a full load with continuous replication from the on-premises database to Aurora.
When the migration is complete update the Route 53 entry for the database to point to the Aurora cluster endpoint and shut down the on-premises database.

Answer

During nonbusiness hours shut down the on-premises database and create a backup Restore this backup to an Amazon Aurora DB cluster. When the restoration is complete update the Route 53 entry for the database to point to the Aurora cluster endpoint and shut down the on-premises database.

Answer

Create a backup of the database and restore it to an Amazon Aurora multi-master cluster. This Aurora cluster will be in a master-master replication configuration with the on-premises database. Update the Route 53 entry for the database to point to the Aurora cluster endpoint and shut down the on-premises database.

Question 14

NO.13 A life Sciences company is using a combination of open source tools to manage data analysis workflows and Docker containers running on servers in its on-premises data to process genemics data. Sequencing data is generated and stored on a local storage area network (SAN) and then the data is processed. The research and development teams are running into capacity issues and have decided to re-architect their genomics analysis platform on AWS to scale based on workload demands and reduce the turn around time from weeks to days. The company has a high-speed AWS Direct Connect connection Sequencers will generate around 200 GB of data for each genome, and individual hours to process the data with ideal compute capacity. The end result will be stored in Amazon S3. The company is expecting 10-15 job requests each day. Which solution meets these requirements?

Accepted Answer

Use AWS DataSync to transfer the sequensing data to Amazon S3. Use S3 events to trigger an AWS Lambada function that starts an AWS Step Functions workflow. Store the Docker images in Amazon Elastic Container Registry (Amazon ECR) and trigger AWS Batch to run the container and process the sequencing data.

Answer

Use regularly scheduled AWS snowball Edge devices to transfer the sequencing data into AWS. When AWS receives the Snowball Edge device and the data is loaded into Amazon S3, use events to trigger an AWS Lambada function to process the data.

Answer

Use AWS Data Pipeline to transfer the sequencing data to Amazon S3. Use S3 events to trigger an Amazon EC2 Auto group to launch custom-AMI EC2 instances running he Docker containers to process the data.

Answer

Use an AWS Storage Gateway file gateway to transfer the sequencing data to Amazon S3. Use S3 events to trigger an AWS job that executes on Amazon EC2 instances running the Docker containers to process the data.

Question 15

NO.14 A photo-sharing and publishing company receives 10,000 to 150,000 images daily. The company receives the images from multiple suppliers and users registered with the service. The company is moving to AWS and wants to enrich the existing metadata by adding data using Amazon Rekognition. The following is an example of the additional data:

As part of the cloud migration program, the company uploaded existing image data to Amazon S3 and told users to upload images directly to Amazon S3. 
What should the Solutions Architect do to support these requirements?

Accepted Answer

Trigger AWS Lambda based on an S3 event notification to create additional metadata using Amazon Rekognition. Use Amazon DynamoDB to store the metadata and Amazon ES to create an index. Use a web front-end to provide search capabilities backed by Amazon ES.

Answer

Use Amazon Kinesis to stream data based on an S3 event. Use an application running in Amazon EC2 to extract metadata from the images. Then store the data on Amazon DynamoDB and Amazon CloudSearch and create an index. Use a web front-end with search capabilities backed by CloudSearch.

Answer

Start an Amazon SQS queue based on S3 event notifications. Then have Amazon SQS send the metadata information to Amazon DynamoDB. An application running on Amazon EC2 extracts data from Amazon Rekognition using the API and adds data to DynamoDB and Amazon ES. Use a web front-end to provide search capabilities backed by Amazon ES.

Answer

Trigger AWS Lambda based on an S3 event notification to create additional metadata using Amazon Rekognition. Use Amazon RDS MySQL Multi-AZ to store the metadata information and use Lambda to create an index. Use a web front-end with search capabilities backed by Lambda.

Question 16

NO.15 A company has a data lake in Amazon S3 that needs to be accessed by hundreds of applications across many AWS accounts. The company's information security policy states that the S3 bucket must not be accessed over the public internet and that each application should have the minimum permissions necessary to function. To meet these requirements, a solution architect plans to use an S3 access point that is restricted to specific VPCs for each application. 
Which combination of steps should the solutions architect take to implement this solution? (Choose Two)

Accepted Answer

Create an S3 access point for each application in the AWS account that owns the S3 bucket. Configure each access point to be accessible only from the application's VPC. Update the bucket policy to require access from an access point.

Accepted Answer

Create a gateway endpoint for Amazon S3 in each application's VPC. Configure the endpoint policy to allow access to an S3 access point. Specify the route table that is used to access the access point.

Answer

Create an interface endpoint for Amazon S3 in each application's VPC. Configure the endpoint policy to allow access to an S3 access point. Create a VPC gateway attachment for the S3 endpoint.

Answer

Create an S3 access point for each application in each AWS account and attach the access points in the S3 bucket. Configure each access point to accessible only from the application's VPC update the bucket policy to require access from an access point.

Answer

Create a gateway endpoint for Amazon S3 in the data lake's VPC. Attach an endpoint policy to allow access to the S3 bucket. Specify the route table that is used to access the bucket.

Question 17

NO.16 A company has an application that uses Amazon EC2 instances in an Auto Scaling group. The Quality Assurance (QA) department needs to launch a large number of short-lived environments to test the application. The application environments are currently launched by the Manager of the department using an AWS CloudFormation template. To launch the stack, the Manager uses a role with permission to use CloudFormation, EC2 and Auto Scaling APIs. 
The Manager wants to allow testers to launch their own environments, but does not want to grant broad permission to each user. Which set up would achieve these goals?

Accepted Answer

Create an AWS Service Catalog product form the environment template. Add a launch constraint to the product with the existing role. Give users in the QA department permission to use AWS Service Catalog APIs only. Train users to launch the templates form the AWS Service Catalog console.

Answer

Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to assume the Manager's role and add a policy that restricts the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.

Answer

Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to use CloudFormation and S3 APIs, with conditions that restrict the permission to the template and the resources it creates. Train users to launch the template form the CloudFormation console.

Answer

Create an AWS Elastic Beanstalk application from the environment template. Give users in the QA department permission to use Elastic Beanstalk permissions only. Train users to launch Elastic beanstalk environments with the Elastic Beanstalk CLI, passing the existing role to the environment as a service role.

Question 18

NO.17 A company manages more than 200 separate internet-facing web applications. All of the applications are deployed to AWS in a single AWS Region The fully qualified domain names (FQDNs) of all of the applications are made available through HTTPS using Application Load Balancers (ALBs). The ALBs are configured to use public SSL/TLS certificates. A Solutions Architect needs to migrate the web applications to a multi-region architecture. 
All HTTPS services should continue to work without interruption. Which approach meets these requirements?

Accepted Answer

Request certificates for each FQDN in both the primary and secondary AWS Regions using AWS Certificate Manager. Associate the certificates with the corresponding ALBs in each AWS Region.

Answer

Request a certificate for each FQDN using AWS KMS. Associate the certificates with the ALBs in the primary AWS Region. Enable cross-region availability in AWS KMS for the certificates and associate the certificates with the ALBs in the secondary AWS Region.

Answer

Generate the key pairs and certificate requests for each FQDN using AWS KMS. Associate the certificates with the ALBs in both the primary and secondary AWS Regions.

Answer

Request a certificate for each FQDN using AWS Certificate Manager. Associate the certificates with the ALBs in both the primary and secondary AWS Regions.

Question 19

NO 18. A large financial company is deploying applications that consist of Amazon EC2 and Amazon RDS instances to the AWS Cloud using AWS Cloud Formation. The CloudFormation stack has the following stack policy: image.
The company wants to ensure that developers do not lose data by accidentally removing or replacing RDS instances when updating me Cloud Formation stack Developers also still need to be able to modify or remove EC2 instances as needed How should the company change the stack policy to meet these requirements?

Accepted Answer

Add a second statement that specifies "Effect" "Deny" "Action" ["Update'"] for all logical RDS resources

Answer

Modify the statement to specify "Effect" "Deny" "Action" ["Update *"] for all logical RDS resources

Answer

Modify the statement to specify "Effect" "Deny" "Action" ("Update Delete"] for all logical RDS resources

Answer

Add a second statement that specifies "Effect" "Deny" "Action" ["Update Delete" "Update Replace"] for all logical RDS resources

Question 20

NO.19 A company has a web-based application deployed in the ap-southheast-2 Region behind an Application Load Balancer ALB). AWS Certificate Manager (ACM) has issued a TLS certificate for example.com. This certificate is deployed to the ALB. There is a record set in Amazon Route 53 for example.com associated to the ALB. Due to increased load on the application, the company wants to use Amazon CloudFront. This transition cannot cause application downtime. 
Which combination of actions can achieve this? (Choose Three.)

Accepted Answer

Create a new ACM certificate in the ap-southeast-2 Region for origin-example.com and example.com. Associate this certificate to the existing ALB Add a DNS entry in Route 53 for ongin.exampte.com associated with the existing ALB.

Accepted Answer

Create a new ACM certificate in the us-east-1 Region for example.com. Create a CloudFront distribution and use the ACM certificate in the us-east-1 Region. Set origin example.com as the custom origin.

Accepted Answer

Update the ALB security group to allow access from the CloudFront Edge locations only

Answer

Create a CloudFront distribution and use the existing certificate associated with the ALB m the ap- 60Uthaast-2 Region Set origin example com as the custom origin.

Answer

Update Route 53 for oxample.com to the alias record of the CloudFront distribution.

Answer

Create a new ACM certificate in the us-east-1 Region for example.com Create a new ALB in the us-oast-1 Region as the origin of the CloudFront distribution. Attach the security group associated with the ALB to the CloudFront distribution.

Question 21

NO.20 A company would like to implement a serverless application by using Amazon API Gateway, AWS Lambda and Amazon DynamoDB. They deployed a proof of concept and stated that the average response time is greater than what their upstream services can accept Amazon CloudWatch metrics did not indicate any issues with DynamoDB but showed that some Lambda functions were hitting their timeout. 
Which of the following actions should the Solutions Architect consider to improve performance? (Choose two.)

Accepted Answer

Increase the amount of memory and adjust the timeout on the Lambda function. Complete performance testing to identify the ideal memory and timeout configuration for the Lambda function.

Accepted Answer

Enable API cache on the appropriate stage in Amazon API Gateway, and override the TTL for individual methods that require a lower TTL than the entire stage.

Answer

Configure the AWS Lambda function to reuse containers to avoid unnecessary startup time.

Answer

Create an Amazon ElastiCache cluster running Memcached, and configure the Lambda function for VPC integration with access to the Amazon ElastiCache cluster.

Answer

Increase the amount of CPU, and adjust the timeout on the Lambda function. Complete performance testing to identify the ideal CPU and timeout configuration for the Lambda function.

Question 22

NO.21 A company is migrating to the cloud. It wants to evaluate the configurations of virtual machines in its existing data center environment to ensure that it can size new Amazon EC2 instances accurately. The company wants to collect metrics, such as CPU, memory, and disk utilization, and it needs an inventory of what processes are running on each instance. The company would also like to monitor network connections to map communications between servers. 
Which would enable the collection of this data MOST cost effectively?

Accepted Answer

Configure the Amazon CloudWatch agent on all servers within the local environment and publish metrics to Amazon CloudWatch Logs.

Answer

Use AWS Application Discovery Service and deploy the data collection agent to each virtual machine in the data center.

Answer

Use AWS Application Discovery Service and enable agentless discovery in the existing virtualization environment.

Answer

Enable AWS Application Discovery Service in the AWS Management Console and configure the corporate firewall to allow scans over a VPN.

Question 23

NO.22 A company manages an on-premises data ingestion application that receives metrics from loT devices in JSON format. The data is collected transformed and stored m a data warehouse for analysis. The current infrastructure has severe performance issues at peak loads due to insufficient compute capacity causing some of the data ingestion to be dropped. The company wants to migrate the application to AWS The solution must support its current analytics tool that connects to the data warehouse with a Java Database Connectivity (JDBC) driver. 
The company requires a resilient and cost-effective solution that will address the performance issues Which solution will meet these requirements?

Accepted Answer

Replatform the application Create an Application Load Balancer and an Amazon EC2 instance with Auto Scaling to host the application to ingest and transform the data Create an Amazon RDS PostgreSQL Multi-AZ DB instance in a private subnet to store data Use Amazon QuickSight to generate reports and visualize data

Answer

Replatform the application Use Amazon API Gateway to handle data ingestion Use AWS Lambda to transform the data Create an Amazon Aurora PostgreSQL DB cluster with an Aurora Replica in two private subnets to store data Use Amazon QuickSight to generate reports and visualize data

Answer

Re-architect the application Load the data into Amazon S3 Use AWS Glue to transform me data Store the table schema in an AWS Glue Data Catalog Use Amazon Athena to query the data

Answer

Re-architect the application Load the data into Amazon S3 Use Amazon EMR to transform tne data Create an external schema in an AWS Glue Data Catalog Use Amazon Redshift Spectrum to query the data

Question 24

NO.23 A company wants to allow its Marketing team to perform SQL queries on customer records to identify market segments. The data is spread across hundreds of files. The records must be encrypted in transit and at rest. The Team Manager must have the ability to manage users and groups, but no team members should have access to services or resources not required for the SQL queries. Additionally, Administrators need to audit the queries made and receive notifications when a query violates rules defined by the Security team. AWS Organizations has been used to create a new account and an AWS IAM user with administrator permissions for the Team Manager.
Which design meets these requirements?

Accepted Answer

Apply a service control policy (SCP) that denies access to all services except IAM, Amazon Athena, Amazon S3, and AWS CloudTrail. Store customer record files in Amazon S3 and train users to execute queries using the CLI via Athena. Analyze CloudTrail events to audit and alarm on queries against personal data.

Answer

Apply a service control policy (SCP) that allows access to IAM, Amazon RDS, and AWS CloudTrail. Load customer records in Amazon RDS MySQL and train users to execute queries using the AWS CLI. Stream the query logs to Amazon CloudWatch Logs from the RDS database instance. use a subscription filter with AWS lambda functions to audit and alarm on queries against personal data.

Answer

Apply a service control policy (SCP) that denies to all services except IAM, Amazon DynamoDB, and AWS CloudTrail. Store customer records in DynamoDB and train users to execute queries using the AWS CLI. Enable DynamoDB streams to track the queries that are issued and use an AWS Lambda

Answer

Apply a service control policy (SCP) that allows to IAM, Amazon Athena, Amazon S3, and AWS CloudTrail. Store customer records as files in Amazon S3 and train users to leverage the Amazon S3 Select feature and execute queries using the AWS CLI. Enable S3 object-level logging and analyze CloudTrail events to audit and alarm on queries against personal data.

Question 25

NO.24 An online retailer needs to regularly process large product catalogs, which are handled in batches. These are sent out to be processed by people using the Amazon Mechanical Turk service, but the retailer has asked its Solutions Architect to design a workflow orchestration system that allows it to handle multiple concurrent Mechanical Turk operations, deal with the result assessment process, and reprocess failures.
Which of the following options gives the retailer the ability to interrogate the state of every workflow with the LEAST amount of implementation effort?

Accepted Answer

Build the workflow in AWS Step Functions, using it to orchestrate multiple concurrent workflows. The status of each workflow can be visualized in the AWS Management Console, and historical data can be written to Amazon S3 and visualized using Amazon QuickSight.

Answer

Trigger Amazon CloudWatch alarms based upon message visibility in multiple Amazon SQS queues (one queue per workflow stage) and send messages via Amazon SNS to trigger AWS Lambda functions to process the next step. Use Amazon ES and Kibana to visualize Lambda processing logs to see the workflow states.

Answer

Hold workflow information in an Amazon RDS instance with AWS Lambda functions polling RDS for status changes. Worker Lambda functions then process the next workflow steps. Amazon QuickSight will visualize workflow states directly out of Amazon RDS.

Answer

Use Amazon SWF to create a workflow that handles a single batch of catalog records with multiple
worker tasks to extract the data, transform it, and send it through Mechanical Turk. Use Amazon ES
and Kibana to visualize AWS Lambda processing logs to see the workflow states.

Question 26

NO.25 A company that is new to AWS reports it has exhausted its service limits across several accounts that are on the Basic Support plan. The company would like to prevent this from happening in the future. 
What is the MOST efficient way of monitoring and managing all service limits in the company's accounts?

Accepted Answer

Use Amazon CloudWatch and AWS Lambda to periodically calculate the limits across all linked accounts using AWS Trusted Advisor, and use Amazon SNS for notifications if a limit is close to exceeding the threshold. Ensure that the accounts are using the AWS Business Support plan at a minimum.

Answer

Use Amazon CloudWatch and AWS Lambda to periodically calculate the limits across all linked accounts using AWS Trusted Advisor, provide notifications using Amazon SNS if the limits are close to exceeding the threshold.

Answer

Reach out to AWS Support to proactively increase the limits across all accounts. That way, the customer avoids creating and managing infrastructure just to raise the service limits.

Answer

Use Amazon CloudWatch and AWS Lambda to periodically calculate the limits across all linked accounts using AWS Trusted Advisor, programmatically increase the limits that are close to exceeding the threshold.

Question 27

NO.26 A Solutions Architect is designing the storage layer for a data warehousing application. The data files are large, but they have statically placed metadata at the beginning of each file that describes the size and placement of the file's index. The data files are read in by a fleet of Amazon EC2 instances that store the index size, index location, and other category information about the data file in a database. 
That database is used by Amazon EMR to group files together for deeper analysis. What would be the MOST cost-effective, high availability storage solution for this workflow?

Accepted Answer

Store the data files in Amazon S3 and use Range GET for each file's metadata, then index the relevant data.

Answer

Store the data files in Amazon EFS mounted by the EC2 fleet and EMR nodes.

Answer

Store the data files on Amazon EBS volumes and allow the EC2 fleet and EMR to mount and unmount the volumes where they are needed.

Answer

Store the content of the data files in Amazon DynamoDB tables with the metadata, index, and data as their own keys.

Question 28

NO.27 A solutions architect needs to advise a company on how to migrate its on-premises data processing application to the AWS Cloud. Currently, users upload input files through a portal. The web server then stores the uploaded tiles on NAS and messages the processing server over a message queue. Each media file can lake up to 1 hour to process. The company has determined that the number of media files awaiting processing is significantly higher during business hours, with the number of files rapidly declining after business hours. 
What is the MOST cost-effective migration recommendation?

Accepted Answer

Create a queue using Amazon SQS Configure the existing web server to publish to the new queue. Use Amazon EC2 instances in an EC2 Auto Seating group to pull requests from the queue and process the files Scale the EC2 instances based on the SQS queue length Store the processed files in an Amazon S3 bucket

Answer

Create a queue using Amazon SQS Configure the existing web server to publish to the new queue. When there are messages m the queue, invoke an AWS Lambda (unction to pull requests from the queue and process the files Store the processed files in an Amazon S3 bucket

Answer

Create a queue using Amazon MQ Configure the existing web server to publish to the new queue. When there are messages in the queue, create a new Amazon EC2 instance to pull requests from the queue and process the files Store the processed files in Amazon EPS Shut down the EC2 instance after the task is complete

Answer

Create a queue using Amazon MQ Configure the existing web server to publish to the new queue. When there are messages in the queue, invoke an AWS Lambda function to pull requests from the queue and process the files Store the processed files in Amazon EFS

Question 29

NO.28 A media storage application uploads user photos to Amazon S3 for processing. End users are reporting that some uploaded photos are not being processed properly. The Application Developers trace the logs and find that AWS Lambda is experiencing execution issues when thousands of users are on the system simultaneously. 
Issues are caused by: 
* Limits around concurrent executions. 
* The performance of Amazon DynamoDB when saving data. 
Which actions can be taken to increase the performance and reliability of the application? (Choose two.)

Accepted Answer

Evaluate and adjust the write capacity units (WCUs) for the DynamoDB tables.

Accepted Answer

Configure a dead letter queue that will reprocess failed or timed-out Lambda functions.

Answer

Evaluate and adjust the read capacity units (RCUs) for the DynamoDB tables.

Answer

Add an Amazon ElastiCache layer to increase the performance of Lambda functions.

Answer

Use S3 Transfer Acceleration to provide lower-latency access to end users.

Question 30

NO.29 An IoT company has rolled out a fleet of sensors for monitoring temperatures in remote locations. Each device connect to AWS IoT Core and sends a message 30 seconds, updating an Amazon DynamoDB table. A System Administrator users AWS IoT to verify the devices are still sending messages to AWS IoT Core: the database is not updating. 
What should a Solution Architect check to determine why the database is not being updated?

Accepted Answer

Verify that AWS IoT things are using MQTT instead of MQTT over WebScocket, then check that the provisioning has the appropriate policy attached.

Answer

Verify the AWS IoT Device Shadow service is subscribed to the appropriate topic and is executing the AWS Lambda function.

Answer

Verify that AWS IoT monitoring shows that the appropriate AWS IoT rules are being executed, and that the AWS IoT rules are enabled with the correct rule actions.

Answer

Check the AWS IoT Fleet indexing service and verify that the thing group has the appropriate IAM 16 IT Certification Guaranteed, The Easy Way! role to update DynamoDB.

Question 31

NO.30 A company has a single AWS master billing account, which is the root of the AWS Organizations hierarchy. The company has multiple AWS accounts within this hierarchy, all organized into organization units (OUs). More OUS and AWS accounts will continue to be created as other parts of the business migrate applications to AWS. These business units may need to use different AWS services. The Security team is implementing the following requirements for all current and future AWS accounts. 
* Control policies must be applied across all accounts to prohibit AWS servers. 
* Exceptions to the control policies are allowed based on valid use cases. 
Which solution will meet these requirements with minimal optional overhead?

Accepted Answer

Use an SCP In organizations to implement a deny list of AWS service. Apply this SCP at the root level and each OU. Remove the default AWS managed SCP from the root level and all OU levels. For any specific exceptions, modify the SCP attached to that OU, and add the required AWS required services to the allow list.

Answer

Use an SCP in Organizations to implement a deny list of AWS servers. Apply this SCP at the level. For any specific exceptions for an OU, create a new SCP for that OU and add the required AWS services the allow list.

Answer

Use an SCP in Organization to implement a deny list of AWS service. Apply this SCP at each OU level . Leave the default AWS managed SCP at the root level For any specific executions for an OU, create a new SCP for that OU.

Answer

Use an SCP in Organizations to implement an allow list of AWS services. Apply this SCP at the root level. Remove the default AWS managed SCP from the root level and all OU levels. For any specific exceptions for an OU, modify the SCP attached to that OU, and add the required AWS services to the allow list.

Question 32

NO.31 As a part of building large applications in the AWS Cloud, the Solutions Architect is required to implement the perimeter security protection. Applications running on AWS have the following endpoints: 
* Application Load Balancer 
* Amazon API Gateway regional endpoint 
* Elastic IP address-based EC2 instances. 
* Amazon S3 hosted websites. 
* Classic Load Balancer The Solutions

Architect must design a solution to protect all of the listed web front ends and provide the following security capabilities: 
* DDoS protection 
* SQL injection protection 
* IP address whitelist/blacklist 
* HTTP flood protection 
* Bad bot scraper protection \
How should the Solutions Architect design the solution?

Accepted Answer

Deploy Amazon CloudFront in front of all the endpoints. Deploy AWS WAF and AWS Shield Advanced. Add AWS WAF rules to enforce the company's requirements. Use AWS Lambda to automate and enhance the security posture.

Answer

Deploy AWS WAF and AWS Shield Advanced on all web endpoints. Add AWS WAF rules to enforce the company's requirements.

Answer

Deploy Amazon CloudFront in front of all the endpoints. The CloudFront distribution provides perimeter protection. Add AWS Lambda-based automation to provide additional security.

Answer

Secure the endpoints by using network ACLs and security groups and adding rules to enforce the company's requirements. Use AWS Lambda to automatically update the rules.

Question 33

NO.32 A web application is hosted in a dedicated VPC that is connected to a company's on-premises data center over a Site-to-Site VPN connection. The application is accessible from the company network only. This is a temporary non-production application that is used during business hours. The workload is generally low with occasional surges. The application has an Amazon Aurora MySQL provisioned database cluster on the backend. The VPC has an internet gateway and a NAT gateways attached. The web servers are in private subnets in an Auto Scaling group behind an Elastic Load Balancer. The web servers also upload data to an Amazon S3 bucket through the internet. A solutions architect needs to reduce operational costs and simplify the architecture. 
Which strategy should the solutions architect use?

Accepted Answer

Review the Auto Scaling group settings and ensure the scheduled actions are specified to operate the Amazon EC2 instances during business hours only Detach the internet gateway from the VPC and use an Aurora Serverless database. Set up a VPC endpoint for the S3 bucket then update the network routing and security rules and policies related to the changes

Answer

Review the Auto Scaling group settings and ensure the scheduled actions are specified to operate the Amazon EC2 instances during business hours only Use 3-year scheduled Reserved Instances for the web server EC2 instances Detach the internet gateway and remove the NAT gateways from the VPC. Use an Aurora Serverless database and set up a VPC endpoint for the S3 bucket

Answer

Review the Auto Scaling group settings and ensure the scheduled actions are specified to operate the Amazon EC2 instances during business hours only Detach the internet gateway and remove the NAT gateways from the VPC Use an Aurora Serverless database and set up a VPC endpoint for the S3 bucket, then update the network routing and security rules and policies related to the changes

Answer

Use 3-year scheduled Reserved Instances for the web server Amazon EC2 instances. Remove the NAT gateways from the VPC, and set up a VPC endpoint for the S3 bucket. Use Amazon CloudWatch and AWS Lambda to stop and start the Aurora DB cluster so it operates during business hours only. Update the network routing and security rules and policies related to the changes.

Question 34

NO.33 A company has grown through numerous mergers and acquisitions. Due to increasing AWS usage costs, management wants each business unit to submit monthly cost reports with costs allocated to specific projects through the AWS Billing and Cost Management console. A resource tagging strategy involving BusinessUnit and Project tags is already defined. 
Which combination of steps should each business unit take to meet these requirements? (Select Two)

Accepted Answer

Create an AWS Budgets report for each business unit to be sent as an email notification to the finance team monthly. Attach the budget for each of the business unit's projects to the report.

Accepted Answer

Create an AWS Budget report for each business unit to be sent as an email notification to the finance team monthly. Configure a tag filter on the AWS Budget report to automatically add budget that include resources with a matching BusinessUnit tag.

Answer

Create an AWS Cost and Usage Report rule to group resources by the BusinessUnit and Project tags. Create a budget in AWS Budget and attach the cost and usage rule to it.

Answer

Activate the Project tag for cost allocation. Create a budget in AWS Budget in AWS Budgets for each project with a resource filter using the Project tag.

Answer

Create a budget in AWS Budgets for each project with a resource filter using the BusinessUnit tag.

Question 35

NO.34 A company prefers to limit running Amazon EC2 instances to those that were launched from AMIs pre-approved by the Information Security department. The Development team has an agile continuous integration and deployment process that cannot be stalled by the solution. Which method enforces the required controls with the LEAST impact on the development process? (Choose two.)

Accepted Answer

Use IAM policies to restrict the ability of users or other automated entities to launch EC2 instances based on a specific set of pre-approved AMIs, such as those tagged in a specific way by Information Security.

Accepted Answer

Use AWS Config rules to spot any launches of EC2 instances based on non-approved AMIs, trigger an AWS Lambda function to automatically terminate the instance, and publish a message to an Amazon SNS topic to inform Information Security that this occurred. E. Use a scheduled AWS Lambda function to scan through the list of running instances within the virtual private cloud (VPC) and determine if any of these are based on unapproved AMIs. Publish a message to an SNS topic to inform Information Security that this occurred and then shut down the instance.

Answer

Use regular scans within Amazon Inspector with a custom assessment template to determine if the EC2 instance that the Amazon Inspector Agent is running on is based upon a pre-approved AMI. If it is not, shut down the instance and inform information Security by email that this occurred.

Answer

Only allow launching of EC2 instances using a centralized DevOps team, which is given work packages via notifications from an internal ticketing system. Users make requests for resources using this ticketing tool, which has manual information security approval steps to ensure that EC2 instances are only launched from approved AMIs.

Question 36

NO.35 The Security team needs to provide a team of interns with an AWS environment so they can build the serverless video transcoding application. The project will use Amazon S3, AWS Lambda, Amazon API Gateway, Amazon Cognito, Amazon DynamoDB, and Amazon Elastic Transcoder. The interns should be able to create and configure the necessary resources, but they may not have access to create or modify AWS IAM roles. The Solutions Architect creates a policy and attaches it to the interns' group. 
How should the Security team configure the environment to ensure that the interns are self- sufficient?

Accepted Answer

Create roles with the required service permissions, which are assumable by the services. Have the interns create and use a bastion host to create the project resources in the project subnet only.

Answer

Create a policy that allows creation of project-related resources only. Create roles with required service permissions, which are assumable by the services.

Answer

Create a policy that allows creation of all project-related resources, including roles that allow access only to specified resources.

Answer

Create a policy that allows creation of project-related resources only. Require the interns to raise a request for roles to be created with the Security team. The interns will provide the requirements for the permissions to be set in the role.

Question 37

NO.36 A company CFO recently analyzed the company's AWS monthly bill and identified an opportunity to reduce the cost for AWS Elastic Beanstalk environments in use. The CFO has asked a Solutions Architect to design a highly available solution that will spin up an Elastic Beanstalk environment in the morning and terminate it at the end of the day. The solution should be designed with minimal operational overhead and to minimize costs. It should also be able to handle the increased use of Elastic Beanstalk environments among different teams, and must provide a one-stop scheduler solution for all teams to keep the operational costs low. 
What design will meet these requirements?

Accepted Answer

Set up a Linux EC2 Micro instance. Configure an IAM role to allow the start and stop of the Elastic Beanstalk environment and attach it to the instance. Create scripts on the instance to start and stop the Elastic Beanstalk environment. Configure cron jobs on the instance to execute the scripts.

Answer

Develop AWS Lambda functions to start and stop the Elastic Beanstalk environment. Configure a Lambda execution role granting Elastic Beanstalk environment start/stop permissions, and assign the role to the Lambda functions. Configure cron expression Amazon CloudWatch Events rules to trigger the Lambda functions.

Answer

Develop an AWS Step Functions state machine with "wait" as its type to control the start and stop time. Use the activity task to start and stop the Elastic Beanstalk environment. Create a role for Step Functions to allow it to start and stop the Elastic Beanstalk environment. Invoke Step Functions daily.

Answer

Configure a time-based Auto Scaling group. In the morning, have the Auto Scaling group scale up an Amazon EC2 instance and put the Elastic Beanstalk environment start command in the EC2 instance user date. At the end of the day, scale down the instance number to 0 to terminate the EC2 instance.

OAFBF

Crea una cuenta gratis para terminar este test

Preguntas del test (37)

Información

Escríbenos

¿Qué te parece el nuevo diseño?