AWS SAA - Exam B - Quiz, Trivia & Questions

2.

Users submit requests to a service that takes several minutes to process. A Solutions Architect needs to ensure that these requests are processed at least once, and that the service has the ability to handle large increases in the number of requests.How should these requirements be met?

A. Put the requests into an Amazon SQS queue and configure Amazon EC2 instances to poll the queue
B. Publish the message to an Amazon SNS topic that an Amazon EC2 subscriber can receive and process
C. Save the requests to an Amazon DynamoDB table with a DynamoDB stream that triggers an Amazon EC2 Spot Instance
D. Use Amazon S3 to store the requests and configure an event notification to have Amazon EC2 instances process the new object

Correct Answer

A. A. Put the requests into an Amazon SQS queue and configure Amazon EC2 instances to poll the queue

Explanation

To meet the requirement of processing requests at least once and handling large increases in the number of requests, option A is the correct choice. By putting the requests into an Amazon SQS queue, the requests are stored in a reliable and scalable queue. Configuring Amazon EC2 instances to poll the queue ensures that the requests are processed. This approach allows for horizontal scaling by adding more EC2 instances to handle increased request loads. Therefore, option A meets the given requirements effectively.

Rate this question:

3.

An application server needs to be in a private subnet without access to the Internet. The solution must retrieve and upload files to an Amazon S3 bucket. How should a Solutions Architect design a solution to meet these requirements?

A. Use Amazon S3 VPC endpoints
B. Deploy a proxy server
C. Use a NAT Gateway
D. Use a private Amazon S3 bucket

Correct Answer

A. A. Use Amazon S3 VPC endpoints

Explanation

A. Use Amazon S3 VPC endpoints

This option is the correct answer because Amazon S3 VPC endpoints allow the application server to securely access the S3 bucket without needing to traverse the public internet. VPC endpoints are virtual devices that are horizontally scaled, redundant, and highly available, providing a secure connection between the VPC and S3. By using VPC endpoints, the application server can retrieve and upload files to the S3 bucket while remaining in a private subnet without internet access. This ensures that the solution meets the requirement of keeping the application server isolated from the internet.

Rate this question:

4.

You are responsible for a legacy web application whose server environment is approaching end of life You would like to migrate this application to AWS as quickly as possible, since the application environment currently has the following limitations: The VM's single 10GB VMDK is almost full Me virtual network interface still uses the 10Mbps driver, which leaves your 100Mbps WAN connection completely underutilized It is currently running on a highly customized. Windows VM within a VMware environment: You do not have me installation media This is a mission critical application with an RTO (Recovery Time Objective) of 8 hours. RPO (Recovery Point Objective) of 1 hour. How could you best migrate this application to AWS while meeting your business continuity requirements?

A. Use the EC2 VM Import Connector for vCenter to import the VM into EC2.
B. Use Import/Export to import the VM as an ESS snapshot and attach to EC2.
C. Use S3 to create a backup of the VM and restore the data into EC2.
D. Use me ec2-bundle-instance API to Import an Image of the VM into EC2

Correct Answer

A. A. Use the EC2 VM Import Connector for vCenter to import the VM into EC2.

Explanation

The correct answer is A. Use the EC2 VM Import Connector for vCenter to import the VM into EC2. This option allows for the migration of the legacy web application to AWS by using the EC2 VM Import Connector for vCenter. This tool enables the import of the virtual machine (VM) into EC2, ensuring a quick migration process. By utilizing this method, the application can be moved to AWS while meeting the business continuity requirements, including the RTO and RPO objectives.

Rate this question:

5.

Your company currently has a 2-tier web application running in an on-premises data center. You have experienced several infrastructure failures in the past two months resulting in significant financial losses. Your CIO is strongly agreeing to move the application to AWS. While working on achieving buy-in from the other company executives, he asks you to develop a disaster recovery plan to help improve Business continuity in the short term. He specifies a target Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour or less. He also asks you to implement the solution within 2 weeks. Your database is 200GB in size and you have a 20Mbps Internet connection. How would you do this while minimizing costs?

A. Create an EBS backed private AMI which includes a fresh install of your application. Develop a CloudFormation template which includes your AMI and the required EC2, AutoScaling, and ELB resources to support deploying the application across Multiple- Availability-Zones. Asynchronously replicate transactions from your on-premises database to a database instance in AWS across a secure VPN connection.
B. Deploy your application on EC2 instances within an Auto Scaling group across multiple availability zones. Asynchronously replicate transactions from your on-premises database to a database instance in AWS across a secure VPN connection.
C. Create an EBS backed private AMI which includes a fresh install of your application. Setup a script in your data center to backup the local database every 1 hour and to encrypt and copy the resulting file to an S3 bucket using multi-part upload.
D. Install your application on a compute-optimized EC2 instance capable of supporting the application's average load. Synchronously replicate transactions from your on-premises database to a database instance in AWS across a secure Direct Connect connection.

Correct Answer

A. A. Create an EBS backed private AMI which includes a fresh install of your application. Develop a CloudFormation template which includes your AMI and the required EC2, AutoScaling, and ELB resources to support deploying the application across Multiple- Availability-Zones. Asynchronously replicate transactions from your on-premises database to a database instance in AWS across a secure VPN connection.

Explanation

The correct answer is A because it addresses the requirements given by the CIO. By creating an EBS backed private AMI, the application can be easily deployed in AWS. The CloudFormation template ensures that the application is deployed across multiple availability zones, improving availability and reducing the risk of infrastructure failures. Asynchronously replicating transactions from the on-premises database to a database instance in AWS ensures a Recovery Point Objective (RPO) of 1 hour or less. The secure VPN connection ensures the data is transferred securely. Overall, this solution meets the specified RTO and RPO targets while minimizing costs.

Rate this question:

6.

An AWS customer is deploying an application mat is composed of an AutoScaling group of EC2 Instances. The customers' security policy requires that every outbound connection from these instances to any other service within the customers Virtual Private Cloud must be authenticated using a unique x 509 certificate that contains the specific instance-id. In addition, an x 509 certificates must Designed by the customer's Key management service in order to be trusted for authentication. Which of the following configurations will support these requirements?

A. Configure an IAM Role that grants access to an Amazon S3 object containing a signed certificate and configure me Auto Scaling group to launch instances with this role Have the instances bootstrap get the certificate from Amazon S3 upon first boot.
B. Embed a certificate into the Amazon Machine Image that is used by the Auto Scaling group Have the launched instances generate a certificate signature request with the instance's assigned instance- id to the Key management service for signature.
C. Configure the Auto Scaling group to send an SNS notification of the launch of a new instance to the trusted key management service. Have the Key management service generate a signed certificate and send it directly to the newly launched instance.
D. Configure the launched instances to generate a new certificate upon first boot Have the Key management service poll the AutoScaling group for associated instances and send new instances a certificate signature (hat contains the specific instance-id.

Correct Answer

A. A. Configure an IAM Role that grants access to an Amazon S3 object containing a signed certificate and configure me Auto Scaling group to launch instances with this role Have the instances bootstrap get the certificate from Amazon S3 upon first boot.

7.

A Solutions Architect is building an online shopping application where users will be able to browse items, add items to a cart, and purchase the items. Images of items will be stored in Amazon S3 buckets organized by item category. When an item is no longer available for purchase, the item image will be deleted from the S3 bucket. Occasionally, during testing, item images deleted from the S3 bucket are still visible to some users. What is a flaw in this design approach?

A. Defining S3 buckets by item may cause partition distribution errors, which will impact performance.
B. Amazon S3 DELETE requests are eventually consistent, which may cause other users to view items that have already been purchased
C. Amazon S3 DELETE requests apply a lock to the S3 bucket during the operation, causing other users to be blocked
D. Using Amazon S3 for persistence exposes the application to a single point of failure

Correct Answer

A. B. Amazon S3 DELETE requests are eventually consistent, which may cause other users to view items that have already been purchased

Explanation

The flaw in this design approach is that Amazon S3 DELETE requests are eventually consistent, which means that it may take some time for the deletion to propagate across all regions and for all users to see the updated state. This can result in some users still being able to view items that have already been purchased, leading to a poor user experience and potential confusion.

Rate this question:

8.

A customer has a 10 GB AWS Direct Connect connection to an AWS region where they have a web application hosted on Amazon Elastic Computer Cloud (EC2). The application has dependencies on an on-premises mainframe database that uses a BASE (Basic Available. Sort stale Eventual consistency) rather than an ACID (Atomicity. Consistency isolation. Durability) consistency model. The application is exhibiting undesirable behavior because the database is not able to handle the volume of writes. How can you reduce the load on your on-premises database resources in the most cost-effective way?

A. Use an Amazon Elastic Map Reduce (EMR) S3DistCp as a synchronization mechanism between the on-premises database and a Hadoop cluster on AWS.
B. Modify the application to write to an Amazon SQS queue and develop a worker process to flush the queue to the on-premises database.
C. Modify the application to use DynamoDB to feed an EMR cluster which uses a map function to write to the on-premises database.
D. Provision an RDS read-replica database on AWS to handle the writes and synchronize the two databases using Data Pipeline

Correct Answer

A. B. Modify the application to write to an Amazon SQS queue and develop a worker process to flush the queue to the on-premises database.

Explanation

By modifying the application to write to an Amazon SQS queue and developing a worker process to flush the queue to the on-premises database, the load on the on-premises database resources can be reduced. This approach decouples the application from the database, allowing for asynchronous processing and reducing the volume of writes directly to the database. Using Amazon SQS also provides scalability and fault tolerance. This solution is cost-effective as it leverages existing AWS services without the need for additional infrastructure or data synchronization mechanisms.

Rate this question:

1

9.

You have launched an EC2 instance with four (4) 500 GB EBS Provisioned IOPS volumes attached The EC2 Instance Is EBS-Optimized and supports 500 Mbps throughput between EC2 and EBS. The two EBS volumes are configured as a single RAID o device, and each Provisioned IOPS volume is provisioned with 4.000 IOPS (4 000 16KB reads or writes) for a total of 16.000 random IOPS on the instance The EC2 Instance initially delivers the expected 16 000 IOPS random read and write performance Sometime later in order to increase the total random I/O performance of the instance, you add an additional two 500 GB EBS Provisioned IOPS volumes to the RAID Each volume Is provisioned to 4.000 IOPs like the original four for a total of 24.000 IOPS on the EC2 instance Monitoring shows that the EC2 instance CPU utilization increased from 50% to 70%. but the total random IOPS measured at the instance level does not increase at all. What is the problem and a valid solution?

A. Larger storage volumes support higher Provisioned IOPS rates: increase the provisioned volume storage of each of the 6 EBS volumes to 1TB
B. The EBS-Optimized throughput limits the total IOPS that can be utilized use an EBS-Optimized instance that provides larger throughput.
C. Small block sizes cause performance degradation, limiting the I'O throughput, configure the instance device driver and file system to use 64KB blocks to increase throughput.
D. RAID 0 only scales linearly to about 4 devices, use RAID 0 with 4 EBS Provisioned IOPS volumes but increase each Provisioned IOPS EBS volume to 6.000 IOPS.
E. The standard EBS instance root volume limits the total IOPS rate, change the instant root volume to also be a 500GB 4.000 Provisioned IOPS volume.

Correct Answer

A. E. The standard EBS instance root volume limits the total IOPS rate, change the instant root volume to also be a 500GB 4.000 Provisioned IOPS volume.

Explanation

The problem is that the total random IOPS measured at the instance level does not increase even after adding additional EBS volumes. The valid solution is to change the instance root volume to also be a 500GB 4,000 Provisioned IOPS volume. This is because the standard EBS instance root volume limits the total IOPS rate, and by changing it to a Provisioned IOPS volume, the total random I/O performance of the instance can be increased.

Rate this question:

10.

An ERP application is deployed across multiple AZs in a single region. In the event of failure, the Recovery Time Objective (RTO) must be less than 3 hours, and the Recovery Point Objective (RPO) must be 15 minutes the customer realizes that data corruption occurred roughly 1.5 hours ago. What DR strategy could be used to achieve this RTO and RPO in the event of this kind of failure?

A. Take hourly DB backups to S3, with transaction logs stored in S3 every 5 minutes.
B. Use synchronous database master-slave replication between two availability zones.
C. Take hourly DB backups to EC2 Instance store volumes with transaction logs stored In S3 every 5 minutes.
D. Take 15-minute DB backups stored In Glacier with transaction logs stored in S3 every 5 minutes.

Correct Answer

A. A. Take hourly DB backups to S3, with transaction logs stored in S3 every 5 minutes.

Explanation

The correct answer is A because taking hourly database backups to S3 ensures that the RPO is met by having backups available every hour. Additionally, storing transaction logs in S3 every 5 minutes ensures that the RPO is met by having the most recent transaction logs available in case of data corruption. This strategy allows for a recovery time objective of less than 3 hours, as the customer can restore the most recent backup and replay the transaction logs to recover the data.

Rate this question:

11.

You require the ability to analyze a large amount of data, which is stored on Amazon S3 using Amazon Elastic Map Reduce. You are using the cc2 8x large Instance type, whose CPUs are mostly idle during processing. Which of the below would be the most cost efficient way to reduce the runtime of the job?

A. Create smaller files on Amazon S3.
B. Add additional cc2 8x large instances by introducing a task group.
C. Use smaller instances that have higher aggregate I/O performance.
D. Create fewer, larger files on Amazon S3.

Correct Answer

A. C. Use smaller instances that have higher aggregate I/O performance.

Explanation

Using smaller instances that have higher aggregate I/O performance would be the most cost-efficient way to reduce the runtime of the job. Since the cc2 8x large instances have mostly idle CPUs, using smaller instances with higher I/O performance would utilize the available resources more effectively and reduce the overall runtime of the job. This would result in cost savings as the job would be completed faster without the need for additional instances or unnecessary file management.

Rate this question:

12.

An application running on AWS Lambda requires an API key to access a third-party service. The key must be stored securely with audited access to the Lambda function only. What is the MOST secure way to store the key?

A. As an object in Amazon S3
B. As a secure string in AWS Systems Manager Parameter Store
C. Inside a file on an Amazon EBS volume attached to the Lambda function
D. Inside a secrets file stored on Amazon EFS

Correct Answer

A. B. As a secure string in AWS Systems Manager Parameter Store

Explanation

The most secure way to store the API key is as a secure string in AWS Systems Manager Parameter Store. This service provides a central location to securely store and manage sensitive information such as passwords, database credentials, and API keys. It encrypts the stored values and provides fine-grained access control, allowing audited access to the Lambda function only. Storing the key in Amazon S3, an EBS volume, or an EFS file would not provide the same level of security and access control.

Rate this question:

13.

You would like to create a mirror image of your production environment in another region for disaster recovery purposes. Which of the following AWS resources do not need to be recreated in the second region? (Choose two.)

A. Route 53 Record Sets
B. IM1 Roles
C. Elastic IP Addresses (EIP)
D. EC2 Key Pairs
E. Launch configurations
F. Security Groups

Correct Answer(s)

A. A. Route 53 Record Sets
A. B. IM1 Roles

Explanation

Route 53 Record Sets and IM1 Roles do not need to be recreated in the second region because they are globally available resources. Route 53 Record Sets can be accessed from any region and IM1 Roles can be used across regions. The other resources mentioned (Elastic IP Addresses, EC2 Key Pairs, Launch configurations, and Security Groups) are region-specific and would need to be recreated in the second region for disaster recovery purposes.

Rate this question:

14.

You've been brought in as solutions architect to assist an enterprise customer with their migration of an ecommerce platform to Amazon Virtual Private Cloud (VPC) The previous architect has already deployed a 3-tier VPC, The configuration is as follows: You are now ready to begin deploying EC2 instances into the VPC. Web servers must have direct access to the internet. Application and database servers cannot have direct access to the internet. Which configuration below will allow you the ability to remotely administer your application and database servers, as well as allow these servers to retrieve updates from the Internet?

A. Create a bastion and NAT instance in subnet-258bc44d, and add a route from rtb- 238bc44b to the NAT instance.
B. Add a route from rtb-238bc44b to igw-2d8bc445 and add a bastion and NAT instance within subnet-248bc44c.
C. Create a bastion and NAT instance in subnet-248bc44c, and add a route from rtb- 238bc44b to subnet-258bc44d.
D. Create a bastion and NAT instance in subnet-258bc44d, add a route from rtb-238bc44b to Igw- 2d8bc445, and a new NACL that allows access between subnet-258bc44d and subnet-248bc44c.

Correct Answer

A. A. Create a bastion and NAT instance in subnet-258bc44d, and add a route from rtb- 238bc44b to the NAT instance.

Explanation

The correct configuration is to create a bastion and NAT instance in subnet-258bc44d and add a route from rtb-238bc44b to the NAT instance. This configuration allows the web servers to have direct access to the internet while ensuring that the application and database servers do not have direct access. The NAT instance acts as a gateway for the private servers to retrieve updates from the internet, and the route from the route table ensures that the traffic is directed to the NAT instance.

Rate this question:

15.

A 3-tier e-commerce web application is current deployed on-premises and will be migrated to AWS for greater scalability and elasticity. The web server currently shares read-only data using a network distributed file system The app server tier uses a clustering mechanism for discovery and shared session state that depends on IP multicast The database tier uses shared-storage clustering to provide database fall over capability, and uses several read slaves for scaling Data on all servers and the distributed file system directory is backed up weekly to off-site tapes. Which AWS storage and database architecture meets the requirements of the application?

Web servers: store read-only data in S3, and copy from S3 to root volume at boot time. App servers: share state using a combination of DynamoDB and IP unicast. Database: use RDS with multi- AZ deployment and one or more read replicas. Backup: web servers, app servers, and database backed up weekly to Glacier using snapshots. 1
Web servers: store read-only data in an EC2 NFS server, mount to each web server at boot time. App servers: share state using a combination of DynamoDB and IP multicast. Database: use RDS with multi-AZ deployment and one or more Read Replicas. Backup: web and app servers backed up weekly via AMIs, database backed up via DB snapshots.
Web servers: store read-only data in S3, and copy from S3 to root volume at boot time. App servers: share state using a combination of DynamoDB and IP unicast. Database: use RDS with multi- AZ deployment and one or more Read Replicas. Backup: web and app servers backed up weekly via AMIs, database backed up via DB snapshots.
Web servers: store read-only data in S3, and copy from S3 to root volume at boot time. App servers: share state using a combination of DynamoDB and IP unicast. Database: use RDS with multi- AZ deployment. Backup: web and app servers backed up weekly via AMIs, database backed up via DB snapshots.

Correct Answer

A. Web servers: store read-only data in S3, and copy from S3 to root volume at boot time. App servers: share state using a combination of DynamoDB and IP unicast. Database: use RDS with multi- AZ deployment and one or more read replicas. Backup: web servers, app servers, and database backed up weekly to Glacier using snapshots. 1

Explanation

The correct answer is the first option. This architecture meets the requirements of the application by storing read-only data in S3 and copying it to the root volume of the web servers at boot time. The app servers share state using DynamoDB and IP unicast. The database uses RDS with multi-AZ deployment and read replicas for scalability. Additionally, the web servers, app servers, and database are backed up weekly to Glacier using snapshots, ensuring data protection.

Rate this question:

16.

Your company produces customer commissioned one-of-a-kind skiing helmets combining nigh fashion with custom technical enhancements Customers can show off their Individuality on the ski slopes and have access to head-up-displays. GPS rear-view cams and any other technical innovation they wish to embed in the helmet. The current manufacturing process is data rich and complex including assessments to ensure that the custom electronics and materials used to assemble the helmets are to the highest standards Assessments are a mixture of human and automated assessments you need to add a new set of assessment to model the failure modes of the custom electronics using GPUs with CUDA, across a cluster of servers with low latency networking. What architecture would allow you to automate the existing process using a hybrid approach and ensure that the architecture can support the evolution of processes over time?

A. Use AWS Data Pipeline to manage movement of data & meta-data and assessments Use an autoscaling group of G2 instances in a placement group.
B. Use Amazon Simple Workflow (SWF) to manages assessments, movement of data & meta-data Use an auto-scaling group of G2 instances in a placement group.
C. Use Amazon Simple Workflow (SWF) to manages assessments movement of data & meta-data Use an auto-scaling group of C3 instances with SR-IOV (Single Root I/O Virtualization).
D. Use AWS data Pipeline to manage movement of data & meta-data and assessments use auto- scaling group of C3 with SR-IOV (Single Root I/O virtualization).

Correct Answer

A. B. Use Amazon Simple Workflow (SWF) to manages assessments, movement of data & meta-data Use an auto-scaling group of G2 instances in a placement group.

17.

A web design company currently runs several FTP servers that their 250 customers use to upload and download large graphic files. They wish to move this system to AWS to make it more scalable, but they wish to maintain customer privacy and Keep costs to a minimum. What AWS architecture would you recommend?

A. ASK their customers to use an S3 client instead of an FTP client. Create a single S3 bucket Create an IAM user for each customer Put the IAM Users in a Group that has an IAM policy that permits access to sub-directories within the bucket via use of the 'username' Policy variable.
B. Create a single S3 bucket with Reduced Redundancy Storage turned on and ask their customers to use an S3 client instead of an FTP client Create a bucket for each customer with a Bucket Policy that permits access only to that one customer.
C. Create an auto-scaling group of FTP servers with a scaling policy to automatically scale-in when minimum network traffic on the auto-scaling group is below a given threshold. Load a central list of ftp users from S3 as part of the user Data startup script on each Instance.
D. Create a single S3 bucket with Requester Pays turned on and ask their customers to use an S3 client instead of an FTP client Create a bucket tor each customer with a Bucket Policy that permits access only to that one customer

Correct Answer

A. A. ASK their customers to use an S3 client instead of an FTP client. Create a single S3 bucket Create an IAM user for each customer Put the IAM Users in a Group that has an IAM policy that permits access to sub-directories within the bucket via use of the 'username' Policy variable.

Explanation

The recommended AWS architecture is to ask customers to use an S3 client instead of an FTP client. A single S3 bucket should be created, and an IAM user should be created for each customer. These IAM users should be grouped together and given an IAM policy that allows access to sub-directories within the bucket using the 'username' Policy variable. This architecture ensures customer privacy by maintaining separate sub-directories for each customer while also minimizing costs by using a single S3 bucket.

Rate this question:

18.

Your company hosts a social media site supporting users in multiple countries. You have been asked to provide a highly available design tor the application that leverages multiple regions tor the most recently accessed content and latency sensitive portions of the wet) site The most latency sensitive component of the application involves reading user preferences to support web site personalization and ad selection. In addition to running your application in multiple regions, which option will support this application's requirements?

A. Serve user content from S3. CloudFront and use Route53 latency-based routing between ELBs in each region Retrieve user preferences from a local DynamoDB table in each region and leverage SQS to capture changes to user preferences with SOS workers for propagating updates to each table.
B. Use the S3 Copy API to copy recently accessed content to multiple regions and serve user content from S3. CloudFront with dynamic content and an ELB in each region Retrieve user preferences from an ElasticCache cluster in each region and leverage SNS notifications to propagate user preference changes to a worker node in each region.
C. Use the S3 Copy API to copy recently accessed content to multiple regions and serve user content from S3 CloudFront and Route53 latency-based routing Between ELBs In each region Retrieve user preferences from a DynamoDB table and leverage SQS to capture changes to user preferences with SOS workers for propagating DynamoDB updates.
D. Serve user content from S3. CloudFront with dynamic content, and an ELB in each region Retrieve user preferences from an ElastiCache cluster in each region and leverage Simple Workflow (SWF) to manage the propagation of user preferences from a centralized OB to each ElastiCache cluster.

Correct Answer

A. A. Serve user content from S3. CloudFront and use Route53 latency-based routing between ELBs in each region Retrieve user preferences from a local DynamoDB table in each region and leverage SQS to capture changes to user preferences with SOS workers for propagating updates to each table.

Explanation

The correct answer is A because it suggests serving user content from S3 and CloudFront, which provides high availability and low latency. Using Route53 latency-based routing between ELBs in each region ensures that requests are directed to the region with the lowest latency. Retrieving user preferences from a local DynamoDB table in each region allows for quick access and reduces latency. Leveraging SQS to capture changes to user preferences with SOS workers ensures that updates are propagated efficiently to each table. This design meets the requirements of a highly available and latency-sensitive application.

Rate this question:

19.

You are designing a data leak prevention solution for your VPC environment. You want your VPC Instances to be able to access software depots and distributions on the Internet for product updates. The depots and distributions are accessible via third party CONs by their URLs. You want to explicitly deny any other outbound connections from your VPC instances to hosts on the Internet. Which of the following options would you consider?

A. Configure a web proxy server in your VPC and enforce URL-based rules for outbound access Remove default routes.
B. Implement security groups and configure outbound rules to only permit traffic to software depots.
C. Move all your instances into private VPC subnets remove default routes from all routing tables and add specific routes to the software depots and distributions only..
D. Implement network access control lists to all specific destinations, with an Implicit deny as a rule

Correct Answer

A. A. Configure a web proxy server in your VPC and enforce URL-based rules for outbound access Remove default routes.

Explanation

Option A suggests configuring a web proxy server in the VPC and enforcing URL-based rules for outbound access while removing default routes. This option allows VPC instances to access software depots and distributions on the Internet for product updates while explicitly denying any other outbound connections to hosts on the Internet. By using URL-based rules, only specific URLs for the depots and distributions will be allowed, providing a more secure data leak prevention solution. Removing default routes ensures that all outbound traffic goes through the web proxy server, allowing for better control and monitoring of the connections.

Rate this question:

20.

An application produces monthly reports that must be immediately accessible for up to 7 days. After 7 days, the data can be archived. Compliance policies require that the archived data be retrievable within 24 hours of a request. What is the MOST cost-effective approach to satisfy the compliance requirement?

A. Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days, then transition to the GLACIER storage class after 30 days
B. Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days
C. Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to the GLACIER storage class after 30 days
D. Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to the GLACIER storage class after 7 days

Correct Answer

A. B. Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days

Explanation

Storing the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days is the most cost-effective approach to satisfy the compliance requirement. This approach allows the data to be immediately accessible for up to 7 days, meeting the requirement for immediate accessibility. After 7 days, the data is transitioned to S3 Standard-IA, which is a lower-cost storage option suitable for data that is accessed less frequently. This helps to reduce storage costs while still maintaining compliance with the requirement to retain the data.

Rate this question:

21.

A company has an application that generates invoices and makes the invoices available online. Invoices are stored as PDFs in an Amazon S3 bucket. Customers typically only view each invoice during the month it is issued. However, past invoices need to be immediately available. There are concerns over rising storage costs as the company gains more customers. What is the MOST cost-effective method to store the data?

A. Use Amazon S3 for current invoices. Set up lifecycle rules to migrate invoices to the GLACIER storage class after 30 days.
B. Store the invoices as text files. Use Amazon CloudFront to convert the invoices from text to PDF when customers download invoices.
C. Store the invoices as binaries in an Amazon RDS database instance. Retrieve them from the database when customers request invoices.
D. Use Amazon S3 for current invoices. Set up lifecycle rules to migrate invoices to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Correct Answer

A. D. Use Amazon S3 for current invoices. Set up lifecycle rules to migrate invoices to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Explanation

Storing the invoices in Amazon S3 and setting up lifecycle rules to migrate them to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days is the most cost-effective method. This allows the company to store the current invoices in a readily accessible storage class while automatically transitioning the past invoices to a lower-cost storage class. S3 Standard-IA provides a lower storage cost compared to S3 Standard, making it a suitable option for storing past invoices that are less frequently accessed. This approach helps to minimize storage costs while ensuring immediate availability of past invoices.

Rate this question:

22.

Your startup wants to implement an order fulfillment process for selling a personalized gadget that needs an average of 3-4 days to produce with some orders taking up to 6 months you expect 10 orders per day on your first day. 1000 orders per day after 6 months and 10,000 orders after 12 months. Orders coming in are checked for consistency men dispatched to your manufacturing plant for production quality control packaging shipment and payment processing If the product does not meet the quality standards at any stage of the process employees may force the process to repeat a step Customers are notified via email about order status and any critical issues with their orders such as payment failure. Your case architecture includes AWS Elastic Beanstalk for your website with an RDS MySQL instance for customer data and orders. How can you implement the order fulfillment process while making sure that the emails are delivered reliably?

A. Add a business process management application to your Elastic Beanstalk app servers and re-use the ROS database for tracking order status use one of the Elastic Beanstalk instances to send emails to customers.
B. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 Use the decider instance to send emails to customers.
C. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 use SES to send emails to customers.
D. Use an SQS queue to manage all process tasks Use an Auto Scaling group of EC2 Instances that poll the tasks and execute them. Use SES to send emails to customers.

Correct Answer

A. C. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 use SES to send emails to customers.

23.

Your company previously configured a heavily used, dynamically routed VPN connection between your onpremises data center and AWS. You recently provisioned a DirectConnect connection and would like to start using the new connection. After configuring DirectConnect settings in the AWS Console, which of the following options win provide the most seamless transition for your users?

A. Delete your existing VPN connection to avoid routing loops configure your DirectConnect router with the appropriate settings and verity network traffic is leveraging DirectConnect.
B. Configure your DirectConnect router with a higher 8GP priority man your VPN router, verify network traffic is leveraging Directconnect and then delete your existing VPN connection.
C. Update your VPC route tables to point to the DirectConnect connection configure your DirectConnect router with the appropriate settings verify network traffic is leveraging DirectConnect and then delete the VPN connection.
D. Configure your DirectConnect router, update your VPC route tables to point to the DirectConnect connection, configure your VPN connection with a higher BGP pointy. And verify network traffic is leveraging the DirectConnect connection.

Correct Answer

A. C. Update your VPC route tables to point to the DirectConnect connection configure your DirectConnect router with the appropriate settings verify network traffic is leveraging DirectConnect and then delete the VPN connection.

Explanation

The most seamless transition for the users would be to first update the VPC route tables to point to the DirectConnect connection. This ensures that the network traffic is directed towards the DirectConnect connection. Then, the DirectConnect router should be configured with the appropriate settings to establish the connection. After verifying that the network traffic is indeed leveraging the DirectConnect connection, the existing VPN connection can be safely deleted. This approach ensures a smooth transition from the VPN connection to the DirectConnect connection without causing any disruptions to the users.

Rate this question:

24.

A newspaper organization has an on-premises application, which allows the public to search its back catalogue and retrieve individual newspaper pages via a website written in Java They have scanned the old newspapers into JPEGs (approx 17TB) and used Optical Character Recognition (OCR) to populate a commercial search product. The hosting platform and software are now end of life and the organization wants to migrate Its archive to AWS and produce a cost efficient architecture and still be designed for availability and durability. Which is the most appropriate?

A. Use S3 with reduced redundancy lo store and serve the scanned files, install the commercial search application on EC2 Instances and configure with auto-scaling and an Elastic Load Balancer.
B. Model the environment using CloudFormation use an EC2 instance running Apache webserver and an open source search application, stripe multiple standard EBS volumes together to store the JPEGs and search index.
C. Use S3 with standard redundancy to store and serve the scanned files, use CloudSearch for query processing, and use Elastic Beanstalk to host the website across multiple availability zones.
D. Use a single-AZ RDS MySQL instance lo store the search index 33d the JPEG images use an EC2 instance to serve the website and translate user queries into SQL.
E. Use a CloudFront download distribution to serve the JPEGs to the end users and Install the current commercial search product, along with a Java Container Tor the website on EC2 instances and use Route53 with DNS round-robin.

Correct Answer

A. C. Use S3 with standard redundancy to store and serve the scanned files, use CloudSearch for query processing, and use Elastic Beanstalk to host the website across multiple availability zones.

Explanation

The most appropriate option is C because it utilizes S3 with standard redundancy to store and serve the scanned files, which ensures durability and availability. CloudSearch is used for query processing, providing an efficient search functionality. Elastic Beanstalk is used to host the website across multiple availability zones, improving availability and scalability. This architecture meets the organization's requirements for cost efficiency, availability, and durability.

Rate this question:

25.

An enterprise wants to use a third-party SaaS application. The SaaS application needs to have access to issue several API commands to discover Amazon EC2 resources running within the enterprise's account The enterprise has internal security policies that require any outside access to their environment must conform to the principles of least privilege and there must be controls in place to ensure that the credentials used by the SaaS vendor cannot be used by any other third party. Which of the following would meet all of these conditions?

A. From the AWS Management Console, navigate to the Security Credentials page and retrieve the access and secret key for your account.
B. Create an IAM user within the enterprise account assign a user policy to the IAM user that allows only the actions required by the SaaS application create a new access and secret key for the user and provide these credentials to the SaaS provider.
C. Create an IAM role for cross-account access allows the SaaS provider's account to assume the role and assign it a policy that allows only the actions required by the SaaS application.
D. Create an IAM role for EC2 instances, assign it a policy that allows only the actions required tor the Saas application to work, provide the role ARM to the SaaS provider to use when launching their application instances.

Correct Answer

A. C. Create an IAM role for cross-account access allows the SaaS provider's account to assume the role and assign it a policy that allows only the actions required by the SaaS application.

Explanation

Option C is the correct answer because it allows the SaaS provider's account to assume the IAM role, ensuring that the credentials used by the SaaS vendor cannot be used by any other third party. Additionally, by assigning a policy to the IAM role that allows only the actions required by the SaaS application, the enterprise's internal security policies of least privilege are met. This solution provides the necessary access to the SaaS application while maintaining security controls. Options A and B do not meet the requirement of ensuring that the credentials cannot be used by any other third party. Option D is not suitable as it is specific to EC2 instances and does not address the requirement of the SaaS application.

Rate this question:

26.

A Solution Architect is creating a serverless web application that must access mapping data in hundreds of data files, each containing approximately 30 KB of data. The storage required is expected to grow to hundreds of terabytes. Which storage solution is most cost-effective, yet still meets the requirements for this use case?

A. Amazon EFS
B. Amazon EBS Cold HDD (sc1)
C. Amazon S3 Standard
D. Amazon DynamoDB

Correct Answer

A. D. Amazon DynamoDB

Explanation

Amazon DynamoDB is the most cost-effective storage solution for this use case. It is a NoSQL database service that provides low-latency access to data at any scale. DynamoDB is designed to handle large amounts of data and can easily accommodate the expected growth to hundreds of terabytes. It is also a serverless service, meaning there is no need to provision or manage servers, which helps reduce costs. Additionally, DynamoDB offers flexible pricing options based on the capacity and throughput needed, allowing for cost optimization based on the specific requirements of the application.

Rate this question:

27.

A company is developing a new stateless web service with low memory requirements. The service needs to scale based on demand. What is the MOST cost-effective solution?

A. Deploy the application onto AWS Elastic Beanstalk
B. Deploy the application onto AWS Lambda with access through Amazon API Gateway
C. Deploy the application onto an Amazon EC2 Spot Fleet
D. Deploy the application onto a container with an Amazon ECS EC2 launch type

Correct Answer

A. C. Deploy the application onto an Amazon EC2 Spot Fleet

Explanation

Deploying the application onto an Amazon EC2 Spot Fleet is the most cost-effective solution because Spot instances offer significant cost savings compared to On-Demand instances. Spot Fleet allows you to request and manage a fleet of Spot instances, taking advantage of unused capacity in the Amazon EC2 infrastructure. This solution is suitable for a stateless web service with low memory requirements that needs to scale based on demand. AWS Elastic Beanstalk, AWS Lambda, and Amazon ECS with EC2 launch type are also viable options, but they may not be as cost-effective as using Spot instances.

Rate this question:

28.

A Solutions Architect must design a web application that will be hosted on AWS, allowing users to purchase access to premium, shared content that is stored in an S3 bucket. Upon payment, content will be available for download for 14 days before the user is denied access. Which of the following would be the LEAST complicated implementation?

A. Use an Amazon CloudFront distribution with an origin access identity (OAI). Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design a Lambda function to remove data that is older than 14 days.
B. Use an S3 bucket and provide direct access to the file. Design the application to track purchases in a DynamoDB table. Configure a Lambda function to remove data that is older than 14 days based on a query to Amazon DynamoDB.
C. Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design the application to set an expiration of 14 days for the URI.
D. Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design the application to set an expiration of 60 minutes for the URL, and recreate the URL as necessary.

Correct Answer

A. C. Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design the application to set an expiration of 14 days for the URI.

Explanation

Option C is the least complicated implementation because it utilizes Amazon CloudFront with an Origin Access Identity (OAI) to provide access to the content stored in an S3 bucket. The distribution is configured to generate signed URLs, which ensures secure access to the files. The application is designed to set an expiration of 14 days for the URI, allowing users to download the content for a limited time before access is denied. This implementation does not require additional components like DynamoDB or Lambda functions for tracking and removing data, making it simpler compared to the other options.

Rate this question:

29.

Company B is launching a new game app for mobile devices. Users will log into the game using their existing social media account to streamline data capture. Company B would like to directly save player data and scoring information from the mobile app to a DynamoDS table named Score Data When a user saves their game the progress data will be stored to the Game state S3 bucket. What is the best approach for storing data to DynamoDB and S3?

A. Use an EC2 Instance that is launched with an EC2 role providing access to the Score Data DynamoDB table and the GameState S3 bucket that communicates with the mobile app via web services.
B. Use temporary security credentials that assume a role providing access to the Score Data DynamoDB table and the Game State S3 bucket using web identity federation.
C. Use Login with Amazon allowing users to sign in with an Amazon account providing the mobile app with access to the Score Data DynamoDB table and the Game State S3 bucket.
D. Use an IAM user with access credentials assigned a role providing access to the Score Data DynamoDB table and the Game State S3 bucket for distribution with the mobile app.

Correct Answer

A. B. Use temporary security credentials that assume a role providing access to the Score Data DynamoDB table and the Game State S3 bucket using web identity federation.

Explanation

The best approach for storing data to DynamoDB and S3 in this scenario is to use temporary security credentials that assume a role providing access to the Score Data DynamoDB table and the Game State S3 bucket using web identity federation. This approach ensures that users can securely log in to the game using their existing social media account and that their progress data is stored in the Game state S3 bucket. By using temporary security credentials, the access to the DynamoDB table and S3 bucket is limited and can be easily managed, providing an extra layer of security for the stored data.

Rate this question:

30.

Your company plans to host a large donation website on Amazon Web Services (AWS). You anticipate a large and undetermined amount of traffic that will create many database writes. To be certain that you do not drop any writes to a database hosted on AWS. Which service should you use?

A. Amazon RDS with provisioned IOPS up to the anticipated peak write throughput.
B. Amazon Simple Queue Service (SOS) for capturing the writes and draining the queue to write to the database.
C. Amazon ElastiCache to store the writes until the writes are committed to the database.
D. Amazon DynamoDB with provisioned write throughput up to the anticipated peak write throughput

Correct Answer

A. B. Amazon Simple Queue Service (SOS) for capturing the writes and draining the queue to write to the database.

31.

Your company is in the process of developing a next generation pet collar that collects biometric information to assist families with promoting healthy lifestyles for their pets Each collar will push 30kb of biometric data In JSON format every 2 seconds to a collection platform that will process and analyze the data providing health trending information back to the pet owners and veterinarians via a web portal Management has tasked you to architect the collection platform ensuring the following requirements are met. Provide the ability for real-time analytics of the inbound biometric data Ensure processing of the biometric data is highly durable. Elastic and parallel The results of the analytic processing should be persisted for data mining Which architecture outlined below win meet the initial requirements for the collection platform?

A. Utilize S3 to collect the inbound sensor data analyze the data from S3 with a daily scheduled Data Pipeline and save the results to a Redshift Cluster.
B. Utilize Amazon Kinesis to collect the inbound sensor data, analyze the data with Kinesis clients and save the results to a Redshift cluster using EMR.
C. Utilize SQS to collect the inbound sensor data analyze the data from SQS with Amazon Kinesis and save the results to a Microsoft SQL Server RDS instance.
D. Utilize EMR to collect the inbound sensor data, analyze the data from EUR with Amazon Kinesis and save me results to DynamoDB.

Correct Answer

A. B. Utilize Amazon Kinesis to collect the inbound sensor data, analyze the data with Kinesis clients and save the results to a Redshift cluster using EMR.

Explanation

Option B is the correct answer because it utilizes Amazon Kinesis, which is a real-time data streaming service, to collect the inbound sensor data. It also allows for analysis of the data using Kinesis clients, ensuring real-time analytics. The results of the analysis are then saved to a Redshift cluster using EMR, which provides a highly durable, elastic, and parallel processing capability. This architecture meets all the requirements stated in the question.

Rate this question:

32.

Your system recently experienced down time during the troubleshooting process. You found that a new administrator mistakenly terminated several production EC2 instances. Which of the following strategies will help prevent a similar situation in the future? The administrator still must be able to: - launch, start stop, and terminate development resources. - launch and start production instances.

A. Create an IAM user, which is not allowed to terminate instances by leveraging production EC2 termination protection.
B. Leverage resource based tagging along with an IAM user, which can prevent specific users from terminating production EC2 resources.
C. Leverage EC2 termination protection and multi-factor authentication, which together require users to authenticate before terminating EC2 instances
D. Create an IAM user and apply an IAM role which prevents users from terminating production EC2 instances.

Correct Answer

A. B. Leverage resource based tagging along with an IAM user, which can prevent specific users from terminating production EC2 resources.

Explanation

Option B suggests leveraging resource-based tagging along with an IAM user to prevent specific users from terminating production EC2 resources. By using resource-based tagging, specific EC2 instances can be tagged as "production" and only users with the necessary permissions can terminate those instances. This strategy allows the administrator to still have the ability to launch and start production instances while preventing them from mistakenly terminating them.

Rate this question:

33.

Your website is serving on-demand training videos to your workforce. Videos are uploaded monthly in high resolution MP4 format. Your workforce is distributed globally often on the move and using companyprovided tablets that require the HTTP Live Streaming (HLS) protocol to watch a video. Your company has no video transcoding expertise and it required you may need to pay for a consultant. How do you implement the most cost-efficient architecture without compromising high availability and quality of video delivery'?

A. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number of nodes depending on the length of the queue. EBS volumes to host videos and EBS snapshots to incrementally backup original files after a few days. CloudFront to serve HLS transcoded videos from EC2.
B. Elastic Transcoder to transcode original high-resolution MP4 videos to HLS. EBS volumes to host videos and EBS snapshots to incrementally backup original files after a few days. CloudFront to serve HLS transcoded videos from EC2.
C. Elastic Transcoder to transcode original high-resolution MP4 videos to HLS. S3 to host videos with Lifecycle Management to archive original files to Glacier after a few days. CloudFront to serve HLS transcoded videos from S3.
D. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number of nodes depending on the length of the queue. S3 to host videos with Lifecycle Management to archive all files to Glacier after a few days. CloudFront to serve HLS transcoded videos from Glacier.

Correct Answer

A. C. Elastic Transcoder to transcode original high-resolution MP4 videos to HLS. S3 to host videos with Lifecycle Management to archive original files to Glacier after a few days. CloudFront to serve HLS transcoded videos from S3.

Explanation

The correct answer is C because it suggests using Elastic Transcoder to transcode the high-resolution MP4 videos to HLS format, which is required for the company-provided tablets. The videos are then stored in S3, which can be cost-effective and scalable. Lifecycle Management is used to archive the original files to Glacier after a few days, ensuring long-term storage without incurring high costs. Finally, CloudFront is used to serve the HLS transcoded videos from S3, providing global distribution and high availability. This architecture meets the requirements of cost-efficiency, high availability, and quality video delivery.

Rate this question:

1

34.

A web company is looking to implement an external payment service into their highly available application deployed in a VPC. Their application EC2 instances are behind a public lacing ELB Auto scaling is used to add additional instances as traffic increases under normal load the application runs 2 instances in the Auto Scaling group but at peak it can scale 3x in size. The application instances need to communicate with the payment service over the Internet which requires whitelisting of all public IP addresses used to communicate with it. A maximum of 4 whitelisting IP addresses is allowed at a time and can be added through an API. How should they architect their solution?

A. Route payment requests through two NAT instances setup for High Availability and whitelist the Elastic IP addresses attached to the MAT instances.
B. Whitelist the VPC Internet Gateway Public IP and route payment requests through the Internet Gateway.
C. Whitelist the ELB IP addresses and route payment requests from the Application servers through the ELB.
D. Automatically assign public IP addresses to the application instances in the Auto Scaling group and run a script on boot that adds each instances public IP address to the payment validation whitelist API.

Correct Answer

A. A. Route payment requests through two NAT instances setup for High Availability and whitelist the Elastic IP addresses attached to the MAT instances.

35.

A corporate web application is deployed within an Amazon Virtual Private Cloud (VPC) and is connected to the corporate data center via an iPsec VPN. The application must authenticate against the on-premises LDAP server. After authentication, each logged-in user can only access an Amazon Simple Storage Space (S3) keyspace specific to that user. Which two approaches can satisfy these objectives? (Choose two.)

A. Develop an identity broker that authenticates against IAM security Token service to assume a IAM role in order to get temporary AWS security credentials The application calls the identity broker to get AWS temporary security credentials with access to the appropriate S3 bucket.
B. The application authenticates against LDAP and retrieves the name of an IAM role associated with the user. The application then calls the IAM Security Token Service to assume that IAM role. The application can use the temporary credentials to access the appropriate S3 bucket.
C. Develop an identity broker that authenticates against LDAP and then calls IAM Security Token Service to get IAM federated user credentials. The application calls the identity broker to get IAM federated user credentials with access to the appropriate S3 bucket.
D. The application authenticates against LDAP the application, then calls the AWS identity and Access Management (IAM) Security service to log in to IAM using the LDAP credentials, the application can use the IAM temporary credentials to access the appropriate S3 bucket.
E. The application authenticates against IAM Security Token Service using the LDAP credentials, the application uses those temporary AWS security credentials to access the appropriate S3 bucket.

Correct Answer(s)

A. B. The application authenticates against LDAP and retrieves the name of an IAM role associated with the user. The application then calls the IAM Security Token Service to assume that IAM role. The application can use the temporary credentials to access the appropriate S3 bucket.
A. C. Develop an identity broker that authenticates against LDAP and then calls IAM Security Token Service to get IAM federated user credentials. The application calls the identity broker to get IAM federated user credentials with access to the appropriate S3 bucket.

Explanation

The correct answers are B and C.

Option B suggests that the application authenticates against LDAP and retrieves the name of an IAM role associated with the user. It then calls the IAM Security Token Service to assume that IAM role. The application can use the temporary credentials obtained to access the appropriate S3 bucket.

Option C suggests developing an identity broker that authenticates against LDAP and then calls the IAM Security Token Service to get IAM federated user credentials. The application can then call the identity broker to obtain IAM federated user credentials with access to the appropriate S3 bucket.

Both options involve authenticating against LDAP and using IAM Security Token Service to obtain temporary credentials or federated user credentials for accessing the S3 bucket specific to each user.

Rate this question:

36.

A customer has established an AWS Direct Connect connection to AWS. The link is up and routes are being advertised from the customer's end, however the customer is unable to connect from EC2 instances inside its VPC to servers residing in its datacenter. Which of the following options provide a viable solution to remedy this situation? (Choose two.)

A. Add a route to the route table with an iPsec VPN connection as the target.
B. Enable route propagation to the virtual pinnate gateway (VGW).
C. Enable route propagation to the customer gateway (CGW).
D. Modify the route table of all Instances using the 'route' command.
E. Modify the Instances VPC subnet route table by adding a route back to the customer's on-premises environment.

Correct Answer(s)

A. B. Enable route propagation to the virtual pinnate gateway (VGW).
A. E. Modify the Instances VPC subnet route table by adding a route back to the customer's on-premises environment.

Explanation

Enabling route propagation to the virtual private gateway (VGW) allows the VGW to advertise routes to the customer's on-premises environment, which would enable connectivity between EC2 instances and servers in the datacenter. Modifying the Instances VPC subnet route table by adding a route back to the customer's on-premises environment ensures that traffic from the EC2 instances is correctly routed back to the customer's datacenter. These two solutions together address the issue of the customer being unable to connect from EC2 instances to servers in its datacenter.

Rate this question:

37.

A Solutions Architect plans to migrate a load balancer tier from a data center to AWS. Several websites have multiple domains that require secure load balancing. The Architect decides to use Elastic Load Balancing Application Load Balancers. What is the MOST efficient method for achieving secure communication?

A. Create a wildcard certificate and upload it to the Application Load Balancer
B. Create an SNI certificate and upload it to the Application Load Balancer
C. Create a secondary proxy server to terminate SSL traffic before the traffic reaches the Application Load Balancer
D. Let a third-party Certificate Manager manage certificates required to all domains and upload them to the Application Load Balancer

Correct Answer

A. B. Create an SNI certificate and upload it to the Application Load Balancer

Explanation

The most efficient method for achieving secure communication in this scenario is to create an SNI (Server Name Indication) certificate and upload it to the Application Load Balancer. SNI allows the load balancer to determine which certificate to use based on the domain name requested by the client. This eliminates the need for a wildcard certificate or a secondary proxy server, reducing complexity and cost. Using a third-party Certificate Manager to manage the certificates for all domains would also be less efficient as it would introduce additional dependencies and potential points of failure.

Rate this question:

38.

You're running an application on-premises due to its dependency on non-x86 hardware and want to use AWS for data backup. Your backup application is only able to write to POSIX-compatible block- based storage. You have 140TB of data and would like to mount it as a single folder on your file server Users must be able to access portions of this data while the backups are taking place. What backup solution would be most appropriate for this use case?

A. Use Storage Gateway and configure it to use Gateway Cached volumes.
B. Configure your backup software to use S3 as the target for your data backups.
C. Configure your backup software to use Glacier as the target for your data backups.
D. Use Storage Gateway and configure it to use Gateway Stored volumes.

Correct Answer

A. D. Use Storage Gateway and configure it to use Gateway Stored volumes.

39.

Your customer wishes to deploy an enterprise application to AWS which will consist of several web servers, several application servers and a small (50GB) Oracle database information is stored, both in the database and the file systems of the various servers. The backup system must support database recovery whole server and whole disk restores, and individual file restores with a recovery time of no more than two hours. They have chosen to use RDS Oracle as the database. Which backup architecture will meet these requirements?

A. Backup RDS using automated daily DB backups Backup the EC2 instances using AMIs and supplement with file-level backup to S3 using traditional enterprise backup software to provide file level restore
B. Backup RDS using a Multi-AZ Deployment Backup the EC2 instances using Amis, and supplement by copying file system data to S3 to provide file level restore.
C. Backup RDS using automated daily DB backups Backup the EC2 instances using EBS snapshots and supplement with file-level backups to Amazon Glacier using traditional enterprise backup software to provide file level restore
D. Backup RDS database to S3 using Oracle RMAN Backup the EC2 instances using Amis, and supplement with EBS snapshots for individual volume restore.

Correct Answer

A. A. Backup RDS using automated daily DB backups Backup the EC2 instances using AMIs and supplement with file-level backup to S3 using traditional enterprise backup software to provide file level restore

Explanation

Option A is the correct answer because it utilizes automated daily DB backups for the RDS Oracle database, ensuring that the database can be recovered in case of any issues. Additionally, it suggests backing up the EC2 instances using AMIs, which allows for whole server and whole disk restores. The option also includes file-level backup to S3 using traditional enterprise backup software, enabling individual file restores with a recovery time of no more than two hours. This backup architecture meets all the requirements specified by the customer.

Rate this question:

40.

You are migrating a legacy client-server application to AWS. The application responds to a specific DNS domain (e.g. www.example.com) and has a 2-tier architecture, with multiple application servers and a database server. Remote clients use TCP to connect to the application servers. The application servers need to know the IP address of the clients in order to function properly and are currently taking that information from the TCP socket. A Multi-AZ RDS MySQL instance will be used for the database. During the migration you can change the application code, but you have to file a change request. How would you implement the architecture on AWS in order to maximize scalability and high availability?

A. File a change request to implement Alias Resource support in the application. Use Route 53 Alias Resource Record to distribute load on two application servers in different AZs.
B. File a change request to implement Latency Based Routing support in the application. Use Route 53 with Latency Based Routing enabled to distribute load on two application servers in different AZs.
C. File a change request to implement Cross-Zone support in the application. Use an ELB with a TCP Listener and Cross-Zone Load Balancing enabled, two application servers in different AZs.
D. File a change request to implement Proxy Protocol support in the application. Use an ELB with a TCP Listener and Proxy Protocol enabled to distribute load on two application servers in different AZs.

Correct Answer

A. D. File a change request to implement Proxy Protocol support in the application. Use an ELB with a TCP Listener and Proxy Protocol enabled to distribute load on two application servers in different AZs.

Explanation

The correct answer is D because it suggests implementing Proxy Protocol support in the application. By using an ELB with a TCP Listener and Proxy Protocol enabled, the load can be distributed on two application servers in different Availability Zones (AZs). This setup allows the application servers to know the IP address of the clients, which is necessary for proper functioning. Additionally, using multiple AZs provides high availability and scalability.

Rate this question:

41.

Your department creates regular analytics reports from your company's log files. All log data is collected in Amazon S3 and processed by daily Amazon Elastic MapReduce (EMR) jobs that generate daily PDF reports and aggregated tables in CSV format for an Amazon Redshift data warehouse. Your CFO requests that you optimize the cost structure for this system. Which of the following alternatives will lower costs without compromising average performance of the system or data integrity for the raw data?

A. Use reduced redundancy storage (RRS) for all data In S3. Use a combination of Spot Instances and Reserved Instances for Amazon EMR jobs. Use Reserved Instances for Amazon Redshift.
B. Use reduced redundancy storage (RRS) for PDF and .csv data in S3. Add Spot Instances to EMR jobs. Use Spot Instances for Amazon Redshift.
C. Use reduced redundancy storage (RRS) for PDF and .csv data In Amazon S3. Add Spot Instances to Amazon EMR jobs. Use Reserved Instances for Amazon Redshift.
D. Use reduced redundancy storage (RRS) for all data in Amazon S3. Add Spot Instances to Amazon EMR jobs. Use Reserved Instances for Amazon Redshift

Correct Answer

A. D. Use reduced redundancy storage (RRS) for all data in Amazon S3. Add Spot Instances to Amazon EMR jobs. Use Reserved Instances for Amazon Redshift

42.

A Solutions Architect is designing an Amazon VPC that requires access to a remote API server using IPv6. Resources within the VPC should not be accessed directly from the Internet. How should this be achieved?

A. Use a NAT gateway and deny public access using security groups
B. Attach an egress-only internet gateway and update the routing tables
C. Use a NAT gateway and update the routing tables
D. Attach an internet gateway and deny public access using security groups

Correct Answer

A. D. Attach an internet gateway and deny public access using security groups

Explanation

To achieve access to a remote API server using IPv6 while ensuring that resources within the VPC are not accessed directly from the Internet, the correct approach is to attach an internet gateway and deny public access using security groups. By attaching an internet gateway, the VPC can establish connectivity with the Internet. However, by configuring the security groups to deny public access, the resources within the VPC are protected and cannot be directly accessed from the Internet. This ensures that only the remote API server can be accessed via IPv6, while maintaining the desired level of security for the internal resources.

Rate this question:

43.

A company deployed a three-tier web application on Amazon EBS backed Amazon EC2 instances for the web and application tiers, and Amazon RDS for the database tier. The company is concerned about loss of data in the web and application tiers. What is the MOST efficient way to prevent data loss?

A. Create an Amazon EFS file system and run a shell script to copy the data
B. Create an Amazon EBS snapshot using an Amazon CloudWatch Events rule
C. Create an Amazon S3 snapshot policy to back up the Amazon EBS volumes
D. Create a snapshot lifecycle policy that takes periodic snapshots of the Amazon EBS volumes

Correct Answer

A. B. Create an Amazon EBS snapshot using an Amazon CloudWatch Events rule

Explanation

Creating an Amazon EBS snapshot using an Amazon CloudWatch Events rule is the most efficient way to prevent data loss in this scenario. By creating snapshots, the company can capture a point-in-time copy of their EBS volumes, ensuring that even if data is lost or corrupted, they can easily restore it. Using CloudWatch Events allows for automation, as snapshots can be scheduled to occur at regular intervals without manual intervention. This provides a reliable and efficient solution for data protection in the web and application tiers of the three-tier web application.

Rate this question:

44.

A company is running its application in a single region on Amazon EC2 with Amazon EBS and Amazon S3 part of the storage design. What should be done to reduce data transfer costs?

A. Create a copy of the compute environment in another region
B. Convert the application to run on Lambda@Edge
C. Create an Amazon CloudFront distribution with Amazon S3 as the origin
D. Replicate Amazon S3 data to buckets in regions closer to the requester

Correct Answer

A. D. Replicate Amazon S3 data to buckets in regions closer to the requester

Explanation

To reduce data transfer costs, the company should replicate Amazon S3 data to buckets in regions closer to the requester. By doing this, data can be accessed from the nearest region, minimizing the amount of data transferred across regions and reducing costs. This approach takes advantage of Amazon S3's ability to replicate data to different regions, ensuring that the data is readily available in multiple locations for efficient access.

Rate this question:

45.

You need a persistent and durable storage to trace call activity of an IVR (Interactive Voice Response) system. Call duration is mostly in the 2-3 minutes timeframe. Each traced call can be either active or terminated. An external application needs to know each minute the list of currently active calls, which are usually a few calls/second. Put once per month there is a periodic peak up to 1000 calls/second for a few hours. The system is open 24/7 and any downtime should be avoided. Historical data is periodically archived to files. Cost saving is a priority for this project. What database implementation would better fit this scenario, keeping costs as low as possible?

A. Use RDS Multi-AZ with two tables, one for -Active calls" and one for -Terminated calls". In this way the "Active calls_ table is always small and effective to access.
B. Use DynamoDB with a "Calls" table and a Global Secondary Index on a "IsActive'" attribute that is present for active calls only In this way the Global Secondary index is sparse and more effective.
C. Use DynamoDB with a 'Calls" table and a Global secondary index on a 'State" attribute that can equal to "active" or "terminated" in this way the Global Secondary index can be used for all Items in the table.
D. Use RDS Multi-AZ with a "CALLS" table and an Indexed "STATE* field that can be equal to 'ACTIVE" or -TERMINATED" In this way the SOL query Is optimized by the use of the Index.

Correct Answer

A. B. Use DynamoDB with a "Calls" table and a Global Secondary Index on a "IsActive'" attribute that is present for active calls only In this way the Global Secondary index is sparse and more effective.

Explanation

Using DynamoDB with a "Calls" table and a Global Secondary Index on the "IsActive" attribute that is present for active calls only would be the best fit for this scenario. This is because the "Active calls" table is always small and effective to access, which is suitable for the requirement of knowing the list of currently active calls every minute. Additionally, the Global Secondary Index being sparse and more effective helps optimize the query performance. This solution also aligns with the priority of cost saving for the project.

Rate this question:

46.

You are designing the network infrastructure for an application server in Amazon VPC Users will access all the application instances from the Internet as well as from an on-premises network The on- premises network is connected to your VPC over an AWS Direct Connect link. How would you design routing to meet the above requirements?

A. Configure a single routing Table with a default route via the Internet gateway Propagate a default route via BGP on the AWS Direct Connect customer router. Associate the routing table with all VPC subnets.
B. Configure a single routing table with a default route via the internet gateway Propagate specific routes for the on-premises networks via BGP on the AWS Direct Connect customer router Associate the routing table with all VPC subnets..
C. Configure a single routing table with two default routes: one to the internet via an Internet gateway the other to the on-premises network via the VPN gateway use this routing table across all subnets in your VPC,
D. Configure two routing tables one that has a default route via the Internet gateway and another that has a default route via the VPN gateway Associate both routing tables with each VPC subnet

Correct Answer

A. B. Configure a single routing table with a default route via the internet gateway Propagate specific routes for the on-premises networks via BGP on the AWS Direct Connect customer router Associate the routing table with all VPC subnets..

Explanation

The correct answer is B because it suggests configuring a single routing table with a default route via the internet gateway, which allows users to access the application instances from the internet. Additionally, it recommends propagating specific routes for the on-premises networks via BGP on the AWS Direct Connect customer router, ensuring connectivity between the on-premises network and the VPC. Finally, it suggests associating the routing table with all VPC subnets, ensuring consistent routing across the VPC. This design meets the requirements of allowing access from both the internet and the on-premises network.

Rate this question:

47.

Your company has an on-premises multi-tier pHP web application, which recently experienced downtime due to a large burst. In web traffic due to a company announcement. Over the coming days, you are expecting similar announcements to drive similar unpredictable bursts, and are looking to find ways to quickly improve your infrastructures ability to handle unexpected increases in traffic. The application currently consists of 2 tiers a web tier which consists of a load balancer and several Linux Apache web servers as well as a database tier which hosts a Linux server hosting a MySQL database. Which scenario below will provide full site functionality, while helping to improve the ability of your application in the short timeframe required?

A. Failover environment: Create an S3 bucket and configure it for website hosting. Migrate your DNS to Route53 using zone file import, and leverage Route53 DNS failover to failover to the S3 hosted website.
B. Hybrid environment: Create an AMI, which can be used to launch web servers in EC2. Create an Auto Scaling group, which uses the AMI to scale the web tier based on incoming traffic. Leverage Elastic Load Balancing to balance traffic between on-premises web servers and those hosted In AWS.
C. Offload traffic from on-premises environment: Setup a CIoudFront distribution, and configure CloudFront to cache objects from a custom origin. Choose to customize your object cache behavior, and select a TTL that objects should exist in cache.
D. Migrate to AWS: Use VM Import/Export to quickly convert an on-premises web server to an AMI. Create an Auto Scaling group, which uses the imported AMI to scale the web tier based on incoming traffic. Create an RDS read replica and setup replication between the RDS instance and on-premises MySQL server to migrate the database.

Correct Answer

A. C. Offload traffic from on-premises environment: Setup a CIoudFront distribution, and configure CloudFront to cache objects from a custom origin. Choose to customize your object cache behavior, and select a TTL that objects should exist in cache.

Explanation

Option C suggests setting up a CloudFront distribution to offload traffic from the on-premises environment. CloudFront can cache objects from a custom origin, reducing the load on the on-premises servers. By customizing the object cache behavior and setting a TTL (Time-to-Live), objects can be stored in the cache for a specified period, further reducing the load on the servers. This approach helps improve the application's ability to handle unexpected increases in traffic by distributing the load and reducing the strain on the on-premises infrastructure.

Rate this question:

48.

You've been hired to enhance the overall security posture for a very large e-commerce site. They have a well architected multi-tier application running in a VPC that uses ELBs in front of both the web and the app tier with static assets served directly from S3 They are using a combination of RDS and DynamoOB for their dynamic data and then archiving nightly into S3 for further processing with EMR They are concerned because they found questionable log entries and suspect someone is attempting to gain unauthorized access. Which approach provides a cost effective scalable mitigation to this kind of attack?

A. Recommend that they lease space at a DirectConnect partner location and establish a 1G DirectConnect connection to theirvPC they would then establish Internet connectivity into their space, filter the traffic in hardware Web Application Firewall (WAF). And then pass the traffic through the DirectConnect connection into their application running in their VPC,
B. Add previously identified hostile source IPs as an explicit INBOUND DENY NACL to the web tier subnet.
C. Add a WAF tier by creating a new ELB and an AutoScalmg group of EC2 Instances running a hostbased WAF They would redirect Route 53 to resolve to the new WAF tier ELB The WAF tier would thier pass the traffic to the current web tier The web tier Security Groups would be updated to only allow traffic from the WAF tier Security Group
D. Remove all but TLS 1 2 from the web tier ELB and enable Advanced Protocol Filtering This will enable the ELB itself to perform WAF functionality.

Correct Answer

A. C. Add a WAF tier by creating a new ELB and an AutoScalmg group of EC2 Instances running a hostbased WAF They would redirect Route 53 to resolve to the new WAF tier ELB The WAF tier would thier pass the traffic to the current web tier The web tier Security Groups would be updated to only allow traffic from the WAF tier Security Group

49.

You are designing Internet connectivity for your VPC. The Web servers must be available on the Internet. The application must have a highly available architecture. Which alternatives should you consider? (Choose two.)

A. Configure a NAT instance in your VPC. Create a default route via the NAT instance and associate it with all subnets. Configure a DNS A record that points to the NAT instance public IP address.
B. Configure a CloudFront distribution and configure the origin to point to the private IP addresses of your Web servers. Configure a Route53 CNAME record to your CloudFront distribution.
C. Place all your web servers behind EL8. Configure a Route53 CNMIE to point to the ELB DNS name.
D. Assign EIPs to all web servers. Configure a Route53 record set with all EIPs with health checks and DNS failover.
E. Configure ELB with an EIP. Place all your Web servers behind ELB. Configure a Route53 A record that points to the EIP.

Correct Answer(s)

A. C. Place all your web servers behind EL8. Configure a Route53 CNMIE to point to the ELB DNS name.
A. D. Assign EIPs to all web servers. Configure a Route53 record set with all EIPs with health checks and DNS failover.

Explanation

The correct answers are C and D.

Option C suggests placing all web servers behind an ELB (Elastic Load Balancer) and configuring a Route53 CNAMIE (CNAME) record to point to the ELB DNS name. This ensures that the web servers are highly available and can handle traffic effectively.

Option D suggests assigning Elastic IP addresses (EIPs) to all web servers and configuring a Route53 record set with all EIPs, along with health checks and DNS failover. This also ensures high availability by distributing traffic across multiple servers and monitoring their health.

Both options provide solutions for achieving a highly available architecture for the web servers while ensuring Internet connectivity.

Rate this question:

AWS SAA - Exam B

Amazon EC2 provides virtual computing environments known as _____.

Quiz Preview

Users submit requests to a service that takes several minutes to process. A Solutions Architect needs to ensure that these requests are processed at least once, and that the service has the ability to handle large increases in the number of requests.How should these requirements be met?

An application server needs to be in a private subnet without access to the Internet. The solution must retrieve and upload files to an Amazon S3 bucket. How should a Solutions Architect design a solution to meet these requirements?

An application running on AWS Lambda requires an API key to access a third-party service. The key must be stored securely with audited access to the Lambda function only. What is the MOST secure way to store the key?

You would like to create a mirror image of your production environment in another region for disaster recovery purposes. Which of the following AWS resources do not need to be recreated in the second region? (Choose two.)

A company is developing a new stateless web service with low memory requirements. The service needs to scale based on demand. What is the MOST cost-effective solution?

Your company plans to host a large donation website on Amazon Web Services (AWS). You anticipate a large and undetermined amount of traffic that will create many database writes. To be certain that you do not drop any writes to a database hosted on AWS. Which service should you use?

A Solutions Architect is designing an Amazon VPC that requires access to a remote API server using IPv6. Resources within the VPC should not be accessed directly from the Internet. How should this be achieved?

A company deployed a three-tier web application on Amazon EBS backed Amazon EC2 instances for the web and application tiers, and Amazon RDS for the database tier. The company is concerned about loss of data in the web and application tiers. What is the MOST efficient way to prevent data loss?

A company is running its application in a single region on Amazon EC2 with Amazon EBS and Amazon S3 part of the storage design. What should be done to reduce data transfer costs?

You are designing Internet connectivity for your VPC. The Web servers must be available on the Internet. The application must have a highly available architecture. Which alternatives should you consider? (Choose two.)

AWS SAA Certification Test! Hardest Trivia Quiz

AWS Certified Solutions Architect - Associate (part 1 Test)

AWS SAA Certification Test! Hardest Trivia Quiz