AWS Solution Architect

A company must migrate 20 TB of data from a data centre to the AWS Cloud within 30 days. The company's network bandwidth is limited to 15 Mbps and cannot exceed 70% utilization. What should a solutions architect do to meet these requirements?

• AWS Snowball

• AWS DataSyn

• AWS S3

• AWS Glacier

A solutions architect must create a highly available bastion host architecture. The solution needs to be resilient within a single AWS Region and should require only minimal effort to maintain. What should the solutions architect do to meet these requirements?

• . Create a Network Load Balancer backed by an Auto Scaling group with a UDP listener.

• Create a Network Load Balancer backed by a Spot Fleet with instances in a partition placement group

• Create a Network Load Balancer backed by the existing servers in different Availability Zones as the target

• Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple Availability Zones as the target

A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database Compliance regulations mandate that all personally identifiable information (Pll) be encrypted at rest. Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?

• Deploy AWS Certificate Manager to generate certificates Use the certificates to encrypt the database volume

• Deploy AWS CloudHSM, generate encryption keys, and use the customer master key (CMK) to encrypt database volumes

• Configure SSL encryption using AWS Key Management Service customer master keys (AWS KMS CMKs) to encrypt database volumes.

• Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes

A company is storing an access key (access key ID and secret access key) in a text file on a custom AMI. The company uses the access key to access DynamoDB tables from instances created from the AMI. The security team has mandated a more secure solution. Which solution will meet the security team’s mandate?

• Put the access key in an S3 bucket, and retrieve the access key on boot from the instance.

• Pass the access key to the instances through instance user data.

• Obtain the access key from a key server launched in a private subnet.

• Create an IAM role with permissions to access the table, and launch all instances with the new role.

Company salespeople upload their sales figures daily. A Solutions Architect needs a durable storage solution for these documents that also protects against users accidentally deleting important documents. Which action will protect against unintended user actions?

• Store data in an EBS volume and create snapshots once a week.

• Store data in an S3 bucket and enable versioning.

• Store data in two S3 buckets in different AWS regions.

• Store data on EC2 instance storage.

An application saves the logs to an S3 bucket. A user wants to keep the logs for one month for troubleshooting purposes, and then purge the logs. What feature will enable this?

• Adding a bucket policy on the S3 bucket.

• Configuring lifecycle configuration rules on the S3 bucket.

• Creating an IAM policy for the S3 bucket.

• Enabling CORS on the S3 bucket.

An organization is building an Amazon Redshift cluster in their shared services VPC. The cluster will host sensitive data. How can the organization control which networks can access the cluster?

• Run the cluster in a different VPC and connect through VPC peering.

• Create a database user inside the Amazon Redshift cluster only for users on the network.

• Define a cluster security group for the cluster that allows access from the allowed networks.

• Only allow access to networks that connect with the shared services network via VPN.

An application running on EC2 instances processes sensitive information stored on Amazon S3. The information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 is a security risk. Which solution will resolve the security concern?

• Access the data through an Internet Gateway.

• Access the data through a VPN connection.

• Access the data through a NAT Gateway.

• Access the data through a VPC endpoint for Amazon S3.

A Solutions Architect is designing an online shopping application running in a VPC on EC2 instances behind an ELB Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application tier must read and write data to a customer-managed database cluster. There should be no access to the database from the Internet, but the cluster must be able to obtain software patches from the Internet. Which VPC design meets these requirements?

• Public subnets for both the application tier and the database cluster

• Public subnets for the application tier, and private subnets for the database cluster

• Public subnets for the application tier and NAT Gateway, and private subnets for the database cluster

• Public subnets for the application tier, and private subnets for the database cluster and NAT Gateway

An application requires a highly available relational database with an initial storage capacity of 8 TB. The database will grow by 8 GB every day. To support expected traffic, at least eight read replicas will be required to handle database reads. Which option will meet these requirements?

• DynamoDB

• Amazon S3

• Amazon Aurora

• Amazon Redshift