WLJURG_3

Your company uses an AWS Transit Gateway as a hub to manage the interconnections between multiple VPCs and the on-premises networks. The security team asks you to implement a control that can allow or block the traffic between the EC2 network interface workload and the Transit Gateway. Which of the following approaches would you select? Domain: Design Secure Architectures

• Attach the EC2 instances with an IAM role that has the AWS managed policy “AWSNetworkManagerServiceRolePolicy”
• Associate security groups to the EC2 instance network interface and the Transit Gateway to control the traffic
• Create route tables in the AWS Transit Gateway to allow or disallow the traffic from the EC2 workload
• Apply NACL rules between EC2 instances in the subnets and Transit Gateway associations to control the traffic

You are planning to launch the AWS ECS container instance. You would like to set the ECS container agent configuration during the ECS container instance initial launch. What should you perform to configure container agent information?

• Set configuration in the ECS metadata parameter during cluster creation
• Set configuration in the user data parameter of EC2 instance
• Define configuration in the task definition
• Define configuration in the service definition

Which of the following are valid integration sources for API Gateway? (choose 3 options)

• Public facing HTTP-based endpoints outside AWS network
• Lambda functions from another account
• Database connections on internet outside AWS network
• VPC Link
• SFTP connection

You are a solutions architect working for a financial services firm. Your firm requires a very low latency response time for requests via API Gateway and Lambda integration to your securities master database. The securities master database, housed in Aurora, contains data about all of the securities your firm trades. The data consists of the security ticker, the trading exchange, trading partner firm for the security, etc. As this securities data is relatively static, you can improve the performance of your API Gateway REST endpoint by using API Gateway caching. Your REST API calls for equity security request types and fixed income security request types to be cached separately. Which of the following options is the most efficient way to separate your cache responses via request type using API Gateway caching? Domain: Design High-Performing Architectures

• Payload compression
• Custom domain name
• API Stage
• Query string

You are a solutions architect working for a healthcare provider. Your company uses REST APIs to expose critical patient data to internal front-end systems used by doctors and nurses. The data for your patient information is stored in Aurora. How can you ensure that your patient data REST endpoint is only accessed by your authorized internal users? (Select TWO) Domain: Design Secure Architectures

• Run your Aurora DB cluster on an EC2 instance in a private subnet
• Use a Gateway VPC Endpoint to make your REST endpoint private and only accessible from within your VPC
• Use IAM resource policies to restrict access to your REST APIs by adding the aws:SourceVpce condition to the API Gateway resource policy
• Use an Interface VPC Endpoint to make your REST endpoint private and only accessible from within your VPC and through your VPC endpoint
• Use IAM resource policies to restrict access to your REST APIs by adding the aws:SourceArn condition to the API Gateway resource policy

Which of the following statements is correct with respect to the instance store and EBS volume? (Select TWO) Domain: Design High-Performing Architectures

• Instance store backed EC2 instances will persist storage across instance stop, terminate, and failures
• EBS backed EC2 instances can persist storage across instance stop, terminate, and failures
• Instance store backed EC2 instance will persist storage only during instance stop and start
• You cannot add instance store volumes once the EC2 instance is launched
• All available EC2 instance types support instance store and EBS volumes

You are working in a start-up company, and you need to save the cost of Amazon EC2, AWS Fargate, and AWS Lambda. You are looking for a flexible pricing model. For example, you will be charged at a lower rate if you commit to $10/hour of compute usage. Which AWS service can achieve this requirement? Domain: Design Cost-Optimized Architectures

• AWS Savings Plan
• AWS Reserved Instance
• AWS Dedicated Host
• AWS Spot Instance

You use CloudFormation to create an Auto Scaling group for a web application. The application needs to be deployed in both non-production and production AWS accounts. You want to use Spot Instances in the non-production environment to save costs. Which of the following methods would you choose? Domain: Design Cost-Optimized Architectures

• In the CloudFormation template, use a variable to set the OnDemandPercentageAboveBaseCapacity property. Set the variable to be 100 in non-production and 0 in production
• In the CloudFormation template, use a parameter to set the OnDemandPercentageAboveBaseCapacity property. Set the parameter to be 0 in non-production and 100 in production
• In the CloudFormation template, use a parameter for the SpotMaxPrice property. Set the parameter to be 100 in non-production and 0 in production
• In the CloudFormation template, use a parameter for the SpotMaxPrice property. Set the parameter to be 0.5 in non-production and the On-Demand price in production

You are a solutions architect working as a consultant where you build web applications for clients. One of your clients needs a static website hosted on AWS. The website will host content files owned by the AWS account used to create the S3 bucket that will host the website. However, some of the objects in the bucket that are owned by a parent company’s AWS account are also needed for the website. Domain: Design Secure Architectures

• Create a bucket policy that grants s3:GetObject access to the objects owned by the parent company account
• Disable the block public access setting for the bucket and write a bucket policy that grants public read access for the bucket
• Create an object access control list to grant read permissions on objects owned by the account used to create the S3 bucket that will host the website
• Create an object access control list (ACL) that grants read access to the bucket
• Create a bucket policy that grants s3:GetObject access to the objects owned by the parent company account and the objects owned by the account used to create the S3 bucket that will host the website

Which of the following are system metadata for objects in S3? (choose 3 options) Domain: Design High-Performing Architectures

• x-amz-server-side-encryption
• x-amz-meta-object-id
• x-amz-version-id
• Content-Length
• x-amz-meta-location