AWS Certified Solutions Architect - Associate Exam-2

Name

Surname

QUESTION 1 You have a secure web application hosted on AWS using Application Load Balancers, Auto Scaling, and a fleet of EC2 instances connected to an RDS database. You need to ensure that your RDS database can only be accessed using the profile credentials specific to your EC2 instances (via an authentication token). How can you achieve this?

• Using Active Directory federation via Amazon Inspector
• Using IAM database authentication
• Using IAM roles
• Using Amazon Cognito

QUESTION 2 You use AWS Route53 as your DNS service and you have updated your domain, hello.acloud.guru, to point to a new Elastic Load Balancer (ELB). However, when you check the update it looks like users are still redirected to the old ELB. What could be the problem?

• The A record needs to be changed to a CNAME.
• The CNAME needs to be changed to an A record.
• Your Application Load Balancer needs to be a Network Load Balancer to interface with Route53.
• The TTL needs to expire. After that, the record will be updated.

QUESTION 3 You are working for a startup that is designing a mobile gaming platform. It is being launched by a very famous celebrity, and the frontend servers will experience a lot of heavy traffic during the initial launch. You need to store the users' login and gaming details in memory, and you need caching capability that is compatible with Redis API. Which service should you use?

• Amazon RDS
• Elasticsearch
• Amazon DynamoDB
• Amazon Elasticache

QUESTION 4 You have started a network design for a large pharmaceutical company to migrate their on-premises environment to AWS. The network will be highly complex with over 1,000 VPCs (all of which will need to communicate to each other) as well as having transitive peering between some on-premises data centers while all supporting IP Multicast. What VPC Network Solution should you recommend?

• VPN CloudHub
• AWS Private Link
• Transit Gateway
• Direct Connect

QUESTION 5 You work for an automotive company that has a small estate on AWS, but the majority of their assets are hosted in-house at their own data center. They are now looking to save money by moving more and more real estate to AWS and have started creating multiple AWS accounts in the same Region. As part of their expansion strategy, they plan to deploy multiple VPCs across these AWS accounts. They currently have one Direct Connect connection installed between their on-premises data center and AWS. Now that they have multiple production accounts and a growing number of VPCs, they will need to connect these to the on-premises data center using a dedicated connection. What is the most cost-effective way of doing this?

• Use a VPN concentrator to connect the AWS accounts back to the on-premises data center.
• Create a new Direct Connect gateway and set this up with the existing Direct Connect connection. Set up a transit gateway between the AWS accounts and connect the transit gateway to the Direct Connect gateway.
• Provision an AWS VPN CloudHub and connect the AWS accounts directly back to the Direct Connect connection via a VPN connection.
• Provision a new Direct Connect connection for each AWS account and connect it back to your on-premises data center.

QUESTION 6 You have a web application that is hosted on a series of EC2 instances that have an Application Load Balancer in front of them. You have created a new CloudFront distribution. You then set up its origin to point to your ALB. You need to provide access to hundreds of private files served by your CloudFront distribution. What should you use?

• CloudFront signed cookies
• CloudFront Origin Access Identity
• CloudFront HTTPS encryption
• CloudFront Signed URLS

QUESTION 7 A small startup is beginning to configure IAM for their organization. The user logins have been created and now the focus will shift to the permissions to grant to those users. An admin starts creating identity-based policies. To which item can an identity-based policy not be attached?

• roles
• groups
• users
• resources

QUESTION 8 You have a subscription website that stores private images and videos in S3. You need to distribute that content globally, so you have set up a CloudFront distribution and configured your S3 bucket to only allow the distribution's Origin Access Identity to have access to the data. You want to distribute private content to users for a limited amount of time. Which CloudFront feature allows you to securely distribute this private content?

• Origin Access Identity
• CloudFront Signed URLS
• CloudFront Forward Distributors
• S3 Public Access