Arch Day 2 Review

A company is storing an access key with an access key ID and secret access key in a text file on a custom Amazon Machine Image (AMI). The company uses the access key to access Amazon DynamoDB tables from instances created from the AMI. The security team has mandated a more secure solution.Which solution will meet the security team’s mandate?

• Put the access key in an Amazon S3 bucket and retrieve the access key on boot from the instance.

• Pass the access key to the instances through instance user data.

• Obtain the access key from a key server launched in a private subnet

• Create an IAM role with permissions to access the table and launch all instances with the new role.

An application running on Amazon EC2 instances processes sensitive information stored in Amazon S3. The information is accessed over the internet. The security team is concerned that the internet connectivity to Amazon S3 is a security risk.Which solution will resolve the security concern?

• Access the data through an internet gateway.

• Access the data through a VPN connection.

• Access the data through a NAT gateway.

• Access the data through a VPC endpoint for Amazon S3.

A customer relationship management (CRM)application runs on Amazon EC2 instances in multiple Availability Zones behind an Application Load Balancer.

If one of these instances fails, what occurs?

• The load balancer will stop sending requests to the failed instance.

• The load balancer will terminate the failed instance.

• The load balancer will automatically replace the failed instance.

• The load balancer will return 504 Gateway Timeout errors until the instance is replaced.

A company runs a public-facing three-tier web application in aVPC across multiple Availability Zones. Amazon EC2 instances for the application tier running in private subnets need to download software patches from the internet. However, the instances cannot be directly accessible from the internet.

Which actions should be taken to allow the instances to download the needed patches? (Select TWO.)

• Configure a NAT gateway in a public subnet.

• Define a custom route table with a route to the NAT gateway for internet traffic and associate it with the private subnets for the application tier.

• Assign Elastic IP addresses to the application instances.

• Define a custom route table with a route to the internet gateway for internet traffic and associate it with the private subnets for the application tier.

• Configure a NAT instance in a private subnet.

A company plans to run a monitoring application on an Amazon EC2 instance in a VPC. Connections are made to the instance using its private IPv4 address. A solutions architect needs to design a solution that will allow traffic to be quickly directed to a standby instance if the application fails and becomes unreachable.

Which approach will meet these requirements?

• Deploy an Application Load Balancer configured with a listener for the private IP address and register the primary instance with the load balancer. Upon failure, de-register the instance and register the secondary instance.

• Configure a custom DHCP option set. Configure DHCP to assign the same private IP address to the secondary instance when the primary instance fails.

• Attach a secondary elastic network interface (ENI)to the instance configured with the private IP address. Move the ENI to the standby instance if the primary instance becomes unreachable.

• Associate an Elastic IP address with the network interface of the primary instance. Disassociate the Elastic IP from the primary instance upon failure and associate it with a secondary instance.