Font size
WorksheetsSC-01.2
Total questions: 50
Worksheet time: 29mins
A data analytics company is running a Redshift data warehouse for one of its major clients. In compliance with the Business Continuity Program of the client, they need to provide a Recovery Point Objective of 24 hours and a Recovery Time Objective of 1 hour. The data warehouse should be available even if the entire AWS Region is down.
Which of the following is the most suitable configuration for this scenario?
Configure Redshift to have automatic snapshots and do a cross-region snapshot copy to automatically replicate the current production cluster to the disaster recovery region
No additional configuration needed. Redshift is configured with automatic snapshot by default
Configure Redshift to use Cross-Region Replication (CRR) and in case of system failure, failover to the backup region and manually copy the snapshot from the primary region to the secondary region
Enable Redshift replication from the cluster running in the primary region to the cluster running in the secondary region. Change the DNS endpoint to the secondary cluster's primary node in case of system failures in the primary region
You are working in a fintech startup as a Solutions Architect where you are setting up a cloud architecture that uses an Application Load Balancer in
front of an Auto Scaling group of On-Demand EC2 instances. To lower down the overall cost, one EC2 instance should be terminated whenever the overall CPU utilization is at 15% or lower.
In this scenario, how can you implement a cost-effective and scalable architecture to satisfy the requirement?
Configure a monitoring script that sends out an email using SNS when the CPU utilization is less than 15% so the administrator can manually remove an EC2 instance
Use scheduled actions in the Auto Scaling configuration to automatically terminate EC2 instances when the CPU Utilization hits below 15%
Use CloudWatch for the monitoring and configure the scaling in policy of the Auto Scaling group to terminate one EC2 instance when the CPU Utilization is 15% or below
Use AWS Lambda triggers to send a notification to the Auto Scaling group when the CPU utilization is less than 15% to kick off the scaling in policy to remove the EC2 instance
A top Internet of Things (IoT) company has developed a wrist-worn activity tracker for soldiers deployed in the field. The device acts as a sensor to monitor the health and vital statistics of the wearer. It is expected that there would be thousands of devices that will send data to the server every minute and after 5 years, the number will increase to tens of thousands.
One of the requirements is that, you need to be able to accept the incoming data, run it through ETL to store in a data warehouse and archive the old data. The officers in the military headquarters should have a real-time dashboard to view the sensor data.
What is the most suitable architecture to implement in this scenario?
Leverage on Amazon Athena to accept the incoming data and store them using DynamoDB. Setup a cron job that takes data from the DynamoDB table and sends it to an EMR cluster for ETL, then outputs the result to Redshift
Store the data to an S3 bucket with a lifecycle policy to store in Glacier after a month. Launch an EMR cluster that uses the bucket data and runs it through ETL, which then outputs that data to Redshift
Store the data directly to Amazon Kinesis and output the data to an S3 bucket. For archiving, create a lifecycle policy from S3 to Glacier. Use Lambda to process the data through EMR and sends the output to Redshift
Store the data directly to DynamoDB. Launch a data pipeline that starts an EMR cluster using data from DynamoDB and sends the data to S3 and Redshift
A technology company asked you to develop an educational mobile app for students, with an exam feature that also allows them to submit their answers. You used React Native so the app can be deployed on both iOS and Android devices. You used Lambda and API Gateway for the backend services and DynamoDB as the database service. After a month, you released the app which has been downloaded over 3 million times.
However, there are a lot of users who complain about the slow processing of the app especially when they are submitting their answers in the multiple- choice exams. The diagrams and images on the exam also take a lot of time to load, which is not a good user experience.
Which of the following options provides the most cost-effective and scalable architecture for your app?
Instead of DynamoDB, use RDS Multi-AZ configuration with Read Replicas. Use a web distribution in CloudFront and Amazon S3 to host the diagrams, images, and other static assets of the mobile app
Increase the write capacity in DynamoDB. Use an RTMP (Real-Time Messaging Protocol) distribution in CloudFront to host the diagrams, images and other static assets of the mobile app in real time
Launch an SQS queue and develop a custom service which integrates with SQS to buffer the incoming requests. Use a web distribution in CloudFront and Amazon S3 to host the diagrams, images, and other static assets of the mobile app
Enable Auto Scaling in DynamoDB with a Target Utilization of 100% and a maximum provisioned capacity of 1000 units. Use an S3 bucket to host the diagrams, images, and other static assets of the mobile app
An enterprise application has a Lambda function connected to your VPC, which has a CIDR block of 172.31.0.0/28. The function processes large amounts of financial transactions every hour and then stores the results to a PostgreSQL database hosted in a Reserved EC2 instance. You noticed that there is an increase in invocation errors with EC2 error types such as EC2ThrottledException on certain times of the day.
Which of the following are the possible causes of this issue? (Select TWO)
The associated security group of your function does not allow outbound connections
Your VPC does not have enough subnet ENIs
Your VPC does not have a NAT gateway
Your VPC does not have enough subnet IPs
The attached IAM execution role of your function does not have the necessary permissions to access the resources of your VPC
A global data analytics firm has various data centers from different countries
all over the world. The staff are regularly uploading analytics, financial, and regulatory files of each of their respective data centers to a web portal deployed in AWS, which uses an S3 bucket named global-analytics-reports- bucket to durably store the data. The staff download various reports from a CloudFront distribution which uses the global-analytics-reports-bucket S3 bucket as the origin.
You noticed that the staff are using both the CloudFront link and the direct Amazon S3 URLs to download the reports. The IT Security team of the company sees this as a security risk, and they recommended that you implement a way to prevent anyone from bypassing CloudFront and using the direct Amazon S3 URLs.
What would you do to meet the above requirement?
1. Set up a field-level encryption configuration in the CloudFront distribution. 2. Remove anyone else's permission to use Amazon S3 URLs to read the objects
1. Configure the distribution to use Signed URLs. 2. Create a special CloudFront user called an origin access identity (OAI). 3. Give the origin access identity permission to read the objects in your bucket
1. In your CloudFront distribution, use a custom SSL instead of the default SSL. 2. Remove anyone else's permission to use Amazon S3 URLs to read the objects
1. Create a special CloudFront user called an origin access identity (OAI) and associate it with your CloudFront distribution.2. Give the origin access identity permission to read the objects in your bucket.3. Remove anyone else's permission to use Amazon S3 URLs to read the objects
A legal consulting firm is running a WordPress website on EC2 instances deployed across multiple Availability Zones with a Multi-AZ RDS MySQL database instance. Their website is designed to use an eventual consistency model and performs a high number of read and write operations.
There is a growing number of people who are reporting that the website is slow and after checking, the root cause is due to the slow read processing in your database tier.
Which of the following options would solve this issue? (Choose 2)
Deploy an Amazon ElastiCache Cluster with nodes running in each Availability Zone
Set up a Redis in-memory cache cluster running in an EC2 instance on each Availability Zone and enable replication on all nodes
Implement sharding to distribute the incoming load to multiple RDS MySQL instances
Upgrade the RDS MySQL instance to use provisioned IOPS
Add an RDS MySQL Read Replica in each Availability Zone
A multinational medical research company is migrating their on-premises online repository application to AWS. The application hosts high-resolution endoscopic, cryo-electron microscopy and other anatomical images which are scanned and uploaded by the medical team. The online repository provides various ways to view these images including the ability to zoom in and zoom out on their front-end web application written in ReactJS. The developers implemented the system by splitting each high-resolution image into small individual tiles at multiple zoom levels which are used on various viewing options such as thumbnail, full image, and pinch-to-zoom view. The document can be zoomed at a maximum of 8000 x 6000 pixels in dimension which are split into multiple 20px by 20px image tiles. A group of On- Demand EC2 instances process these tiles by batch and then stored to an S3 bucket.
The front-end application fetches the tiles from the S3 bucket and displays them to viewers as they zoom in and pan around each image. 50 MB is the average size of the tiles for all zoom levels. The original high-resolution images are archived in Amazon Glacier to save costs. The medical research company expects to process and host over a million of scanned documents every year.
Which of the following should you implement to make the current architecture more cost-effective and scalable? (Choose 3)
Use S3 One-Availability Zone Storage class to store the tiles for each zoom level
Store all the high-resolution images as well as its tiles to Glacier to save storage costs and enable the expedited retrieval option
Launch a CloudFront web distribution and use the S3 bucket which hosts the tiles as the origin
At the maximum zoom level, increase the width and height of the individual tiles from 20px by 20px to a much larger 40px by 40px dimension
At the maximum zoom level, decrease the width and height of the individual tiles from 20px by 20px to a much smaller 5px by 5px dimension
You are a Solutions Architect for a Software Development company based in New Jersey. Your manager instructed you to design the network architecture of their new enterprise resource planning (ERP) system in AWS.
The new system should allow access to business managers and analysts over the Internet, whether they are in their hotel rooms, cafes or elsewhere.
However, the ERP system should not be publicly accessible by anyone over the Internet but only to authorized personnel.
Which network design meets the above requirements while minimizing deployment and operational costs?
Establish an IPsec VPN connection and provide the users with the configuration details. Create a public subnet in your VPC and place your application servers in it
Establish an SSL VPN solution in a public subnet of your VPC. Install and configure SSL VPN client software on all the workstations/laptops of the users who need access to the ERP system. Create a private subnet in your VPC and place your application servers behind it
Establish an AWS Direct Connect connection and create a private interface to your VPC. Create a public subnet and place your app servers in it
Deploy the ERP system behind an Elastic Load Balancer with an SSL certificate to allow HTTPS connections
The web portal of a top university is hosted on an Auto Scaling group of EBS- backed EC2 instances with Amazon Aurora as its database. The students can upload their research documents to the portal where the files are stored in one of the attached EBS Volumes. For data redundancy, there is a scheduled job that synchronizes the documents stored in one EBS Volume to all available EBS Volumes attached to all EC2 instances.
The IT Manager noticed that the system performance is quite slow, and he has instructed you to implement a solution to improve the architecture. In this scenario, what will you do to implement a scalable, high throughput POSIX-compliant file system?
Upgrade your existing EBS volumes to Provisioned IOPS SSD Volumes
Use an S3 bucket to store all the files
Use EFS
Use a Glacier to archive the research documents
You are working at the IT department of a top law firm in the country. It was decided that Amazon S3 will be used for storage after an extensive Total Cost of ownership (TCO) analysis comparing S3 versus acquiring more on- premises storage hardware. The attorneys, paralegals, clerks and other employees of the law firm will be using Amazon S3 to store their legal documents and other media files.
For a better user experience, you are planning to implement a single sign-on system in which the user can just use his or her existing Active Directory login to access the S3 storage to avoid having to remember yet another password.
Which of the following should you do to implement this feature and to also provide a mechanism that restricts access for each user to a designated user folder in a bucket? (Choose 2)
Set up a federation proxy or a custom identity provider and use AWS Security Token Service to generate temporary tokens. Use an IAM Role to enable access to AWS services
Configure an IAM Policy that restricts access only to the user-specific folders in the Amazon S3 Bucket
Configure an IAM user that provides access for the user and an IAM Policy that restricts access only to the user-specific folders in the S3 Bucket
Use Amazon Connect to integrate the on-premises Active Directory with Amazon S3 and AWS IAM
Set up a matching IAM user and IAM Policy for every user in your corporate directory that needs access to a folder in the bucket
You formed a new startup company where you develop health-related mobile apps on both iOS and Android devices. Your co-founder developed a sleep tracking app which collects the user's biometric data then stores them in a DynamoDB table, which is configured with on-demand provisioned throughput capacity. Every 9 in the morning, a scheduled task scans the DynamoDB table to extract and aggregate last night’s data for each user and stores the results in an S3 bucket. When the new data is available, the users are then notified via Amazon SNS mobile push notifications.
Due to budget constraints, you want to optimize the current architecture of the backend system to lower costs and increase your bottom line.
Which of the following can you do to further lower the cost in AWS? (Choose 2).
Avail a reserved capacity for provisioned throughput for DynamoDB
Launch a Redshift cluster to replace Amazon DynamoDB. Switch from a Standard S3 bucket to One Zone-Infrequent Access storage class
Use a RDS instance configured with Multi-AZ deployments and Read Replicas as a replacement to your DynamoDB
Set up a scheduled job to drop the DynamoDB table for the previous day that contains the biometric data after it is successfully stored in the S3 bucket. Create another DynamoDB table for the day and perform the deletion and creation process every day
Use ElastiCache to cache reads and writes from the DynamoDB table
A FinTech startup has recently consolidated their multiple AWS accounts using AWS Organizations. They currently have two teams in their organization, a security team and a development team. The former is responsible for protecting their cloud infrastructure and making sure that all their resources are compliant, while the latter is responsible for developing new applications that are deployed to EC2 instances. The security team is required to set up a system that will check if all the running EC2 instances are using an approved AMI. However, the solution should not stop the development team from deploying an EC2 instance running on a non- approved AMI. The disruption is only allowed once the deployment has been completed. In addition, they must set up a notification system that sends
the compliance state of your resources to determine whether they are compliant.
Which of the following is the most suitable solution that the security team should implement?
Create and assign an SCP and an IAM policy that restricts the AWS accounts and the development team from launching an EC2 instance using an unapproved AMI. Create a CloudWatch alarm that will automatically notify the security team if there are non-compliant EC2 instances running in their VPCs
Use an AWS Config Managed Rule and specify a list of approved AMI IDs. This rule will check whether running EC2 instances are using specified AMIs. Configure AWS Config to stream configuration changes and notifications to an Amazon SNS topic which will send a notification for non-compliant instances
Set up a Trusted Advisor check that will verify whether the running EC2 instances in your VPCs are using approved AMIs. Create a CloudWatch alarm and integrate it with the Trusted Advisor metrics that will check all the AMIs being used by your EC2 instances and that will send a notification if there is a running instance which uses an unapproved AMI
Use the Amazon Inspector service to automatically check all the AMIs that are being used by your EC2 instances. Set up an SNS topic that will send a notification to both the security and development teams if there is a non-compliant EC2 instance running in their VPCs
A company stores confidential financial documents as well as sensitive corporate information in an Amazon S3 bucket. There is a new security policy that prohibits any public S3 objects in the company's S3 bucket.
If a public object was identified, the IT Compliance team must be notified immediately, and the object's permissions must be remediated
automatically. The notification must be sent as soon as a public object was created in the bucket.
What is the MOST suitable solution that should be implemented by the Solutions Architect to comply with this data policy?
Set up a Systems Manager (SSM) Automation document that changes any public object in the bucket to private. Integrate CloudWatch Events with AWS Lambda to create a scheduled process that checks the S3 bucket every hour. Configure the Lambda function to invoke the SSM Automation document when a public object is identified and to notify the IT Compliance team via email using Amazon SNS
Automatically track S3 actions using the Trusted Advisor API and AWS Cloud Development Kit (CDK). Set up an Amazon CloudWatch Events rule with an Amazon SNS Topic to notify the IT Compliance team when the Trusted Advisor detected a PutObject API call with public-read permission. Launch another CloudWatch Events rule that invokes an AWS Lambda function to turn the newly uploaded public object to private
Integrate Amazon Lex with Amazon GuardDuty to detect public objects in the S3 bucket and to automatically update the permission of a public object to private. Associate an SNS Topic to Amazon Lex to notify the IT Compliance team via email if a public object was identified
Enable object-level logging in the S3 bucket to automatically track S3 actions using CloudTrail. Set up an Amazon CloudWatch Events rule with an SNS Topic to notify the IT Compliance team when a PutObject API call with public-read permission is detected in the CloudTrail logs. Launch another CloudWatch Events rule that invokes an AWS Lambda function to turn the newly uploaded public object to private
A multinational consumer goods company is currently using a VMWare vCenter Server to manage their virtual machines, multiple ESXi hosts, and all
dependent components from a single centralized location. To save costs and to avail the benefits of cloud computing, the company decided to move their virtual machines to AWS. As the Solutions Architect, you are required to generate new AMIs of your virtual machines which can be launched as an EC2 instance in your VPC.
Which combination of steps should the Architect do to properly execute the cloud migration? (Choose 2)
Use Serverless Application Model (SAM) to migrate the virtual machines (VMs) to AWS and automatically launch an Amazon ECS Cluster to host the VMs
Install the Server Migration Connector to your on-premises virtualization environment
Establish a Direct Connect connection between your data center and your VPC. Use AWS Service Catalog to centrally manage all your IT services and to quickly migrate virtual machines to your virtual private cloud
Use CodePipeline to migrate your on-premises workloads to AWS
Use the AWS Server Migration Service (SMS) to migrate your on- premises workloads to AWS
A multinational consumer goods company runs their website entirely on their on-premises data center. Due to the unprecedented growth of their popular product, they are expecting an increase in the incoming traffic to their website in the coming days ahead. The CTO asked you to urgently do the necessary architectural changes to be able to handle the demand. You suggested to migrate their application to AWS, but the CTO decided that they need at least 3 months to implement a hybrid cloud architecture.
In this scenario, what could they do with their current on-premises website to help offload some of the traffic and scale out to meet the demand in a cost-effective way?
Use an S3 bucket to host all the static files of the website and create a CloudFront RTMP distribution for serving the static files
Replicate the current web infrastructure of the on-premises website on AWS. Offload the DNS to Route 53 and configure weight-based DNS routing to send 50% of the traffic to AWS
Launch a CloudFront web distribution with the URL of the on-premises web application as the origin. Offload the DNS to AWS to handle CloudFront traffic
Use OpsWorks to integrate AWS with the on-premises website and to manage and configure the servers with Auto Scaling to meet the demand
Use OpsWorks to integrate AWS with the on-premises website and to manage and configure the servers with Auto Scaling to meet the demand?
Use AWS Organization, which enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage. Use one master account and multiple member accounts for each department
Consolidate multiple AWS accounts of your organization by providing cross-account access on each account
Setup a cross-account access on all AWS accounts of your organization. Use one master account and multiple member accounts for each department
None of the above
The national election will be held in 6 months’ time and your startup won the bid to build an e-voting system. There would be millions of voters, which is why the system must be able to handle large incoming requests and have a web page to show the real-time poll.
What would be the best and most cost-effective method of architecting this system?
Set up an Auto Scaling group of Spot EC2 instances which pulls the most recent DynamoDB results. Publish the real-time poll results to a custom HTML page hosted in an S3 bucket. Use Route 53 for routing and DNS
Set up a Lambda service which pulls the most recent DynamoDB results. Publish the real-time poll results to a custom HTML page hosted in an S3 bucket. Use a CloudFront distribution and Route 53 for routing and DNS
Launch an Auto Scaling group of Spot EC2 instances with an Application Load Balancer. The EC2 instances shall host the services that fetch the data from DynamoDB table. Launch a web server on an on-demand EC2 instance which is dedicated to publishing the poll results
Build a JavaScript application using Angular or React for the UI of the voting system and host it in S3 static website hosting. Use CloudFront as the CDN and Route 53 for routing. Build an API using Lambda and API Gateway which communicates directly with DynamoDB to post and get the voting data
A leading aerospace engineering company has over 1TB of aeronautical data stored on the corporate file server of their on-premises network. This data is used by a lot of their in-house analytical and engineering applications. The aeronautical data consists of technical files which can have a file size of a few megabytes to multiple gigabytes. The data scientists typically modify an average of 10 percent of these files every day.
Recently, the management decided to adopt a hybrid cloud architecture to better serve their clients around the globe. You are tasked to migrate their applications to AWS over the weekend to minimize any business impact and system downtime. The on-premises data center has a 50-Mbps Internet connection which can be used to transfer all the 1TB of data in AWS but based on your calculations, it will take at least 48 hours to complete this task.
Which of the following options will allow you to move all the aeronautical data to AWS to meet the above requirement?
1. Synchronize the on-premises data to an S3 bucket one week before the migration schedule using the AWS CLI's S3 sync command. 2. Perform a final synchronization task on Friday after the end of business hours. 3. Set up your application hosted in a large EC2 instance in your VPC to use the S3 bucket
1. Synchronize the data from your on-premises data center to an S3 bucket using Multipart upload for large files from Saturday morning to Sunday evening. 2. Configure your application hosted in AWS to use the S3 bucket to serve the aeronautical data files
1. Set up a Gateway-Stored volume gateway using the AWS Storage Gateway service. 2. Establish an iSCSI connection between your on- premises data center and your AWS Cloud then copy the data to the Storage Gateway volume. 3. After all your data has been successfully copied, create an EBS snapshot of the volume. 4. Restore the snapshots as EBS volumes and attach them to your EC2 instances on Sunday
1. At the end of business hours on Friday, start copying the data to a Snowball Edge device. 2. When the Snowball Edge have completely transferred your data to your AWS Cloud, copy all the data to multiple EBS Volumes. 3. On Sunday afternoon, mount the generated EBS volume to your EC2 instances
The latest version of an existing online accounting system, which is using Elastic Beanstalk, is ready to be deployed. The system is used by more than 10,000 clients worldwide 24 hours a day, 7 days a week, which means that the deployment must strictly have zero downtime.
Which of the following deployment methods should you not use for your deployment?
All at once
Rolling
Immutable
Rolling with additional batch
You are working as a Cloud Engineer at a leading insurance company in South East Asia. Your team has recently deployed a new portal that enables your users to login and manage their accounts, view their insurance plans and pay their monthly premiums. After a few weeks, you noticed that there is incoming traffic from a country in which the insurance company does not operate.
Later, you see that the same set of IP addresses coming from the unsupported country is sending out massive amounts of requests to your portal which has caused some minor performance issues.
Which of the following is the best solution to implement to block the series of attacks coming from a set of determined IP ranges?
Launch the online portal on the private subnet
Create an inbound Network Access control list associated with explicit deny rules to block the attacking IP addresses
Launch a Security Group with explicit deny rules to block the attacking
IP addresses
Create a custom route table associated with the web tier and block the attacking IP addresses from the Internet Gateway
A company instructed their Solutions Architect to design a secure content management solution that can be accessed by its external custom applications via API calls. The solution should enable users to upload documents as well as download a specific version or the latest version of a document. There is also a requirement to enable customer administrators to simply submit an API call which can roll back changes to existing files sent to the system.
Which of the following options is the MOST secure and suitable solution that the Architect should implement?
Use Amazon S3 with Versioning and Server Access Logging enabled. Set up an IAM role and access policy for each customer application. Encrypt all documents using client-side encryption for enhanced data security. Share the encryption keys to all customers to unlock the documents. Develop a rollback feature to replace the current document version with the previous version from Amazon S3
Use Amazon WorkDocs for document storage and utilize its user access management, version control, and built-in encryption. Integrate the Amazon WorkDocs Content Manager to the external custom applications. Develop a rollback feature to replace the current document version with the previous version from Amazon WorkDocs
Use Amazon EFS for object storage and enable data encryption in transit with TLS. Store unique customer managed keys in AWS KMS. Set up IAM roles and IAM access policies for EFS to specify separate encryption keys for each customer application. Utilize file locking and file versioning features in EFS to roll back changes to existing files stored in the CMS
Use S3 with Server Access Logging enabled. Set up an IAM role and access policy for each customer application. Use client-side encryption to encrypt customer files then share the Customer Master Key (CMK) ID and the client-side master key to all customers in order to access the CMS
A leading electronics company is getting ready to do a major public announcement of its latest smartphone. Their official website uses an Application Load Balancer in front of Auto Scaling group of On-Demand EC2 instances, which are deployed across multiple Availability Zones with a Multi-AZ RDS MySQL database.
In preparation for their new product launch, you checked the performance of their website and found that the database takes a lot of time to retrieve the data when there are over 100,000 simultaneous requests on the server. The static content such as the images and videos are promptly loaded as expected, but not the customer information that is fetched from the database.
Which of the following could be done to solve this issue in a cost-effective way? (Select TWO)
Add Read Replicas in RDS for each Availability Zone
Implement a caching system using ElastiCache in-memory cache on each Availability Zone
Reduce the latency by switching to Reserved EC2 instances using both Placement Group and Enhanced Networking
Upgrade the RDS MySQL database instance size and increase the provisioned IOPS for faster processing
Configure the database tier to use sharding, which will distribute the incoming load to multiple RDS MySQL instances
A company has a suite of IBM products in their on-premises data center such as IBM WebSphere, IBM MQ, and IBM DB2 servers. You are instructed to migrate all their systems to AWS in the most cost-effective way and improve the availability of your cloud infrastructure.
Which of the following is the MOST suitable solution that you must implement to meet the requirement?
Use the AWS Server Migration Service to migrate your servers to AWS. Set up Amazon EC2 instances to re-host your IBM WebSphere and IBM DB2 servers separately. Re-host and migrate the IBM MQ service to Amazon MQ
Use the AWS Database Migration Service (DMS) and the AWS Schema Conversion Tool (SCT) to convert, migrate, and re-architect the IBM Db2 database to Amazon Aurora. Set up an Auto Scaling group of EC2 instances with an ELB in front to migrate and re-host your IBM WebSphere. Migrate and re-platform IBM MQ to Amazon MQ in a phased approach
Use the AWS Database Migration Service (DMS) and the AWS Schema Conversion Tool (SCT) to convert, re-architect, and migrate the IBM Db2 database to Amazon Aurora. Set up an Auto Scaling group of EC2 instances with an ELB in front to migrate and re-host your IBM WebSphere. Re-host and migrate the IBM MQ service to Amazon SQS FIFO Queue
Use the AWS Server Migration Service to migrate your servers to AWS. Set up Amazon EC2 instances to re-host your IBM WebSphere and IBM DB2 servers separately. Re-host and migrate the IBM MQ service to Amazon SQS Standard Queue
You are working as a Solutions Architect for a major insurance company. They are planning to migrate a MySQL database from their on-premises data center to their AWS Cloud. This is used by a legacy batch application which has steady-state workloads in the morning but has its peak load at night for the end-of-day processing. You are instructed to set up the EC2 and EBS volumes which can handle a maximum of 450 GB of data and can also be used as the system boot volume for your EC2 instance.
Which of the following is the most cost-effective storage type to use in this scenario?
Provisioned IOPS (io1)
Cold HDD (sc1)
Throughput Optimized HDD (st1)
General Purpose (gp2)
A known security vulnerability was discovered in the outdated Operating System of your company's EC2 fleet. As the Systems Administrator, you are responsible in mitigating the vulnerability as soon as possible to safeguard your systems from various cyber security attacks. In addition, you are also required to record all the changes to patch and association compliance statuses.
What is the most efficient way to solve this issue?
Use AWS Systems Manager and Amazon ES to manage, record, and deploy the security patches for the OS for the entire fleet of EC2 instances
Set up Amazon QuickSight and Kibana to apply, monitor, and visualize the patch statuses of all EC2 instances
Use AWS Systems Manager and AWS Config to manage, record, and deploy the security patches for the OS for the entire fleet of EC2 instances
Configure the EC2 fleet to automatically install the security OS patch every week on the provided maintenance window
You are managing an accounting system which consists of an Auto Scaling group of Spot EC2 Instances with an Application Load Balancer in front to distribute the incoming load. The IT security department needs to conduct a vulnerability analysis on these servers to ensure that the EC2 instances comply with the latest security standards. In addition, you should also implement a system that can continuously audit and assess the overall compliance of your AWS resource configurations with your organization’s policies and guidelines.
In this scenario, which of the following options would you implement to satisfy this requirement? (Choose 2)
AWS Config
AWS Systems Manager
AWS WAF
Amazon QuickSight
Amazon Inspector
You are a Cloud Developer who has a web application project using DynamoDB as its data store. The application is expected to receive a high usage load. How could you ensure the scalability and cost-effectiveness of the application to reduce the load on the DynamoDB database?
Run DynamoDB with Multi-AZ configuration enabled using a global index
Use SQS to decouple messages from the application and the database and perform relevant operations in DynamoDB.
Provision more DynamoDB databases to absorb the load
Provision higher write-capacity units (WCUs) to your DynamoDB table
You are working as a Solutions Architect for a major telecommunications company. They are planning to set up a disaster recovery solution for their Amazon Redshift cluster which is being used by their online data analytics application. The database encryption is enabled on their clusters using AWS KMS and it is required that the recovery site should be at least 500 miles from their primary cloud location.
Which of the following is the most suitable solution to meet these requirements and to make their architecture highly available?
Set up a snapshot copy grant for a master key in the destination region and enable cross-region snapshots in your Redshift cluster to copy snapshots of the cluster to another region
In your Redshift cluster, enable the cross-region snapshot copy feature to copy snapshots to another region
Create a new AWS CloudFormation stack which will deploy the cluster in another region and will regularly backup the data to an S3 bucket, configured with cross-region replication. In case of an outage in the primary region, just use the snapshot from the S3 bucket and then start the cluster
Develop a scheduled job using AWS Lambda which will regularly take a snapshot of the Redshift cluster and copy it to another region
You are working as a Solutions Architect for a leading financial company which has multiple AWS accounts that are consolidated with AWS
Organizations. To properly manage all the resources in your organization, you must ensure that the tags are always added when your resources are created across all accounts.
In this scenario, which of the following options are suitable solutions that you can implement? (Choose 2)
Set up the CloudFormation Resource Tags property to apply tags to certain resource types upon creation
Set up AWS generated tags by activating it in the Billing and Cost Management console of the member account
Set up AWS Config to add the corresponding tags to your resources right from the very moment that they are created
Set up AWS Service Catalog to tag the provisioned resources with corresponding unique identifiers for portfolio, product, and users
Set up AWS Systems Manager Automation to automatically add tags to your provisioned resources
You are working as a Solutions Architect for a leading telecommunications company which has multiple business units. You are responsible for setting up their cloud architecture and to make sure that they can centrally manage the policies and billing for their multiple AWS accounts.
Which of the following options would you implement to satisfy this requirement?
Use AWS Organizations to connect all their AWS accounts
Use a separate IAM policy on each account and connect each of them using cross-account access
Set up an IAM group for each business unit, including the necessary IAM role for each administrator
Provision a separate VPC for each business unit and connect them with each other using a fully meshed VPC peering configuration. Use Consolidated Billing to unify the bills of all connected accounts
A TV company is using AWS Storage Gateway to allow their on-premises applications to seamlessly back up their data in AWS and for disaster recovery. After the IT audit activities, it was discovered that their Internet Small Computer Systems Interface (iSCSI) initiators are susceptible to playback attacks.
As the Solutions Architect, how can you fortify the security of the existing architecture and avoid any playback attacks?
Use the Storage Gateway API to configure the gateway to encrypt data stored in the cloud using the AWS Key Management Service (KMS)
Configure a Challenge-Handshake Authentication Protocol (CHAP) to authenticate iSCSI and initiator connections
Use AWS Identity and Access Management (IAM) to help secure your resources by controlling who can access them
Set up a VPN SSL Connection between the on-premises network and your VPC
You are the Chief Technology Officer of a tech company. As part of the financial audit, you plan to use a third-party web application that needs to have certain AWS access to issue several API commands. It will discover Amazon EC2 resources running within the enterprise's account. The enterprise has internal security policies that require any outside access to their environment to conform to the principles of least privilege. You must ensure that the credentials used by the third-party vendor cannot be used by any other third party. The third-party vendor also has an AWS account where it runs its web application and it already provided you a unique customer ID, including their AWS account number.
Which of the following options would meet all these conditions?
Provide your own access key and secret key to the third-party software
Use Amazon Connect to allow the third-party application to access your AWS resources. In the AWS Connect configuration, input the ExternalId context key to ensure that it matches the unique customer ID of the 3rd party vendor
Create an IAM user in the enterprise account that has permissions allowing only the actions required by the third-party application. Also generate a new access key and secret key from the user to be given to the third-party provider
Create a new IAM role for the 3rd-party vendor. Add a permission policy that only allows the actions required by the third-party application. Also, add a trust policy with a Condition element for the ExternalId context key. The Condition must test the ExternalId context key to ensure that it matches the unique customer ID from the 3rd party vendor
You are working as a Solutions Architect for a leading insurance firm where you are instructed to provision access to certain IAM users which performs application development tasks in your VPC. The access should allow the users to create and configure various AWS resources such as deploying Windows EC2 servers. In addition, the users should be able to see the permissions in AWS Organizations to view the information about the user's organization, including the master account email and organization limitations.
Which of the following should you implement to follow the standard security advice of granting least privilege?
Create a new IAM role and attach the AdministratorAccess AWS managed policy to it. Assign the IAM Role to the IAM users
Attach the AdministratorAccess AWS managed policy to the IAM users
Create a new IAM role and attach the SystemAdministrator AWS managed policy to it. Assign the IAM Role to the IAM users
Attach the PowerUserAccess AWS managed policy to the IAM users
You are working in a major robotics company as a Cloud Engineer, and the team is migrating all the web applications hosted on the on-premises network to the AWS cloud. However, some of these apps only support TCP, which means that they will only work on ports 80 and 8080. Your manager also requires you to use an ELB and Auto Scaling to ensure that the traffic is routed properly and ensure scalability of the application.
In this scenario, which listener configuration would you create on the ELB?
Launch and configure an Application Load Balancer with ports HTTP:80 and HTTP:8080, while the instance protocols are set to HTTPS:80 and HTTPS:8080 respectively
Launch and configure an Application Load Balancer with ports HTTP:80 and HTTP:8080 with instance protocols set to TCP:80 and TCP:8080 respectively
Launch and configure a Classic Load Balancer with instance protocols set to HTTP:80 and HTTP:8080
Launch and configure a Classic Load Balancer with instance protocols set to TCP:80 and TCP:8080
You are working as the technical lead of the DevOps team in a cryptocurrency startup company which uses multiple AWS accounts that are all connected using AWS Organizations. Due to the financial nature of the
business, you were instructed by your CTO to prepare for the IT audit activities to meet the compliance requirements.
Which of the following provides the most durable and secure logging solution that you can use to track changes made to all your AWS resources globally?
1. Launch a new CloudTrail trail using the AWS console with an existing S3 bucket to store the logs and with the "Apply trail to all regions" checkbox enabled. 2. Enable MFA Delete on the S3 bucket
1. Launch three new CloudTrail trails using three new S3 buckets to store the logs for the AWS Management console, for AWS SDKs and for the AWS CLI. 2. Enable MFA Delete and Log Encryption on the S3 bucket
1. Launch a new CloudTrail with one new S3 bucket to store the logs. 2. Configure SNS to send log file delivery notifications to your management system. 3. Enable MFA Delete and Log Encryption on the S3 bucket
1. Launch a new CloudTrail trail using the AWS console with one new S3 bucket to store the logs and with the "Apply trail to all regions" checkbox enabled. 2. Enable MFA Delete and Log Encryption on the S3 bucket
You are working as a Solutions Architect for a rental payment startup which enables users to pay for their rent using either their debit or credit cards.
Since the system is not fully compliant with the Payment Card Industry Data Security Standard (PCI DSS), they are using a third-party payment service to handle and process credit card payments on their platform.
Their prototype payments portal uses auto-scaled EC2 instances that are hosted in the default VPC, which are launched in private subnets behind an internal-facing ELB. Upon user payment, the system should connect to the payment service over the Internet to complete the transaction. The solution should be highly available and scalable to avoid any degradation of the service.
What would be the best option to satisfy the above requirement?
Route credit card payment requests from the EC2 instances through NAT Gateway with an associated Elastic IP address
Route credit card payment requests from the Amazon EC2 instances through NAT Instance with an associated Elastic IP address
Whitelist the Internet Gateway Public IP in the Security Group and route payment requests through the Internet Gateway
Route payment requests from the application servers through the ELB directly, which will then be routed to a Customer Gateway
A cinema has an online movie ticketing website which is hosted in an Amazon ECS Cluster and Amazon RDS for MySQL with Multi-AZ deployments configuration. A new version of the system will be deployed which will render the primary RDS instance unavailable for a couple of hours.
In this scenario, what is the process that AWS will use to switch the primary database instance to the standby replica to maintain the availability of the ticketing website?
The primary instance asynchronously replicates data to the standby replica. RDS simply flips the AAAA record in the DNS to point at the standby replica to maintain availability
Both the primary instance and standby replica has an internal IP which will redirect all the incoming requests to each other in the event of RDS database failure
Both the primary instance and standby replica runs independently from each other without any replication. This means that you must manually switch over the DNS to point to the standby replica once you receive the CloudWatch alert that the primary database instance is down
If the primary instance fails, RDS simply flips the canonical name record (CNAME) to point at the standby replica, which is in turn promoted to become the new primary database instance
For performance-testing activities, a Big Data Analytics application is using an Elastic MapReduce cluster which will only be run once. The cluster is designed to ingest 20 TB of data with a total of 30 EC2 instances and is expected to run for about 48 hours.
What is the most cost-effective architecture to use for this scenario?
For both the master and core nodes, use Reserved EC2 instances. For the task nodes, use Spot EC2 instances
Use On-Demand instances for the core nodes. Use Reserved EC2 instances for the master node and Spot EC2 instances for the task nodes
Use a combination of On-Demand instance and Spot Instance types for both the master and core nodes. Use On-Demand EC2 instances for the task nodes
For both the master and core nodes, use On-Demand EC2 instances. For the task nodes, use Spot EC2 instances
The Java-based aerospace data analytics application of a major airline has been re-engineered to use the latest technologies such as NodeJS, GraphQL, WebSockets, and ReactJS. Before deploying the new version to the production environment, your manager asked if Blue/Green deployment is indeed the most suitable strategy to use.
Which of the following are the common case patterns where applying this methodology is not recommended? (Choose 2)
In case your application needs to be deployment aware in which you must use feature flags to control the behavior of the application during the blue/green deployment
If canary analysis or canary testing is preferred, in which you would want the opportunity to validate the new environment by using a very small fraction of production traffic
When the application strictly requires minimum or zero downtime
If you are using a commercial off-the-shelf (COTS) application which comes with a predefined update/upgrade process that isn’t blue/green deployment friendly
If there is a need to have the ability to simply roll the incoming traffic back to the currently working environment, in case of system failures, any time during the deployment process
A company just developed a new podcast collection website that fetches data from an Amazon S3 bucket. However, the application server is in a different domain from the S3. What should you do to allow the new website to access the objects and resources of the S3 bucket from another domain?
Edit ACL policies to allow cross domain access
Configure the bucket to enable cross-origin resource sharing
None of the above
Change the bucket policy to allow cross domain access
Your manager instructed you to move a legacy web application from a virtual machine running inside your data center to your Amazon VPC. However, this application requires private and dedicated connection to
several servers hosted in your on-premises network for it work.
Which combination of options provides the most suitable way to configure the web application running inside the VPC to reach back and access its internal dependencies on your on-premises network? (Choose 2)
An Internet Gateway to allow a VPN connection
An AWS Direct Connect link between the VPC and the network housing the internal services
A network device in your data center that supports Border Gateway Protocol (BGP) and BGP MD5 authentication
Set up a Transit VPC between your on-premises data center and your VPC
An Elastic IP address on the VPC instance
You are working for a large software company which has an on-premises LDAP server and a web application hosted on their VPC. As the Solutions Architect, you are the one who established an IPSec VPN connection between the VPC and the on-premises location.
In this scenario, which of the following options can allow the employees to access the web application and other AWS resources using their corporate account? (Choose 2)
Create an identity broker that authenticates against STS to assume an IAM role to generate temporary AWS security credentials. For user authentication, configure the web application to call the identity broker to get AWS temporary security credentials
Launch an identity broker that authenticates against LDAP server and then calls STS to get IAM federated user credentials. Configure the web application to call the identity broker that you created to get IAM federated user credentials with access to the appropriate AWS service
Configure the web application to authenticate against the on-premises LDAP server and retrieve the name of an IAM role associated with the user. The application then calls the STS to assume that IAM role. The application can use the temporary credentials to access any AWS resource
Integrate the on-premises LDAP server with IAM so the users can log into IAM using their corporate LDAP credentials. Once authenticated, they can use the temporary credentials to access any AWS resource
Your development team has recently finished developing a web application that will soon be put into production. Before they transfer it into the environment, they need to do a final test run. Only the employees can access the app - either on the corporate network or via the Internet. Your manager also instructed you to ensure that the EC2 instance hosting the application server will not be exposed to the Internet.
As a Solutions Architect, which of the following will you implement to fulfill the requirement?
1. Use IPsec VPN that would allow your employees to access the network of your application servers.2. Create a public subnet in your VPC and launch your application servers in it
1. Configure SSL VPN on the public subnet of your VPC. 2. Install an SSL VPN client software on all employee workstations. 3. Create a private subnet in your VPC and place your application servers in it
1. Launch an Elastic Load Balancer for your EC2 instances that terminates SSL to them. 2. Create a public subnet in your VPC and launch your application servers in it
1. Use AWS Direct Connect to hook up your employee workstations to the VPC via a private interface. 2. Create a public subnet and place your application servers in it
You are working as a Solutions Architect for a company that recently adopted a hybrid cloud architecture. Your manager instructed you to create a new VPC, set up the required security configurations, and migrate their web applications. Which of the following services can be used to deploy their applications to the cloud and launch the required AWS resources automatically? (Choose 3)
AWS Elastic Beanstalk
CodeDeploy
AWS OpsWorks
AWS Fargate
AWS CloudFormation
A multinational corporation has recently acquired a smaller company and you were instructed to consolidate the multiple AWS accounts of both entities using AWS Organizations. You set up the required service control policies (SCPs) to simplify the process of controlling access permissions for each individual account and Organizational Units (OUs). However, one account is having trouble in creating a new S3 bucket, and you were tasked to investigate the cause of this issue. The account has the following SCP attached:
{"Version": "2012-10-17","Statement": [ { "Effect": "Allow", "Action":
"cloudtrail:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:*", "Resource": "*" } ]}Each IAM user of the account has the following IAM policy attached:{"Version": "2012-10-17","Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": [ "arn:aws:s3:::*"]}, { "Effect": "Deny",
"NotAction": "s3:*", "NotResource": [ "arn:aws:s3:::*" ] } ]}
Based on the provided SCP and IAM policy, which of the following options could be the possible root cause of this problem?
The SCP is the root cause because it does not support whitelisting actions of the AWS resources
The IAM policy is the root cause because you have denied user permissions to execute any S3-related actions
Both the IAM policy and the SCP are the problem. The SCP should explicitly allow S3 bucket creation in its policy and the IAM policy should exactly match the permissions of the SCP
The SCP is the root cause since it does not explicitly allow the required action that would enable the account to create an S3 bucket
You are a Solutions Architect for a global financial company which has a lot of data centers around the globe. Due to the ever-growing data that your company is storing, you were instructed to set up a durable, cost-effective solution to archive your data from your existing tape-based backup infrastructure to AWS Cloud.
How could you implement this solution in AWS?
Set up a File Gateway which will back up your data in Amazon S3 and archive in Amazon Glacier using your existing tape-based processes
Set up a Tape Gateway which will back up your data in Amazon S3 and archive in Amazon Glacier using your existing tape-based processes
Set up a Tape Gateway which will back up your data in Amazon S3 with point-in-time backups as tapes which will be stored in the Virtual Tape Shelf
Set up a Stored Volume Gateway which will back up your data in Amazon S3 with point-in-time backups as EBS snapshots
A small telecommunications company has recently adopted a hybrid cloud architecture with AWS. They are storing static files of their on-premises web application on a 5 TB gateway-stored volume in AWS Storage Gateway, which is attached to the application server via an iSCSI interface. As part of their disaster recovery plan, they should be able to run the web application on AWS in case that their on-premises network encountered any technical issues.
Which of the following options is the MOST suitable solution that you should implement?
For the static content, create an EFS file system from the AWS Storage Gateway service and mount it to the EC2 instance where the application server is hosted
Restore the static content from an AWS Storage Gateway to an S3 bucket and link it on the EC2 instance where the app server is running
Generate an EBS snapshot of the static content from the AWS Storage Gateway service. Afterwards, restore it to an EBS volume that you can then attach to the EC2 instance where the application server is hosted
Restore the static content by attaching the AWS Storage Gateway to the EC2 instance that hosts the application server
You are developing a new personal finance mobile app that connects to a web server hosted on a small EC2 instance in AWS. The server accepts the requests and data coming from the mobile app, and you would like to integrate the server with DynamoDB as its primary database. As a Solutions Architect, you must allow the EC2 instance to read and write data to the DynamoDB table. You should also add a solution that enables you to analyze, trace, and debug your application easily.
Which combination of steps should the Architect implement to satisfy the above requirement? (Choose 2)
Install and run the Amazon WorkSpaces Application Manager (WAM) to the EC2 instance. Use an instance profile to grant the WAM permission to upload trace data to AWS WorkSpaces
Create an IAM User that allows read and write access to the DynamoDB table then attach it to the running EC2 instance
Create an IAM Role that allows read and write access to the DynamoDB table then attach it to the running EC2 instance
Attach the PowerUserAccess managed policy to the running EC2 instance that will allow read and write access to the DynamoDB table
Install and run the AWS X-Ray daemon to the EC2 instance. Use an instance profile to grant the daemon permission to upload trace data to X-Ray
A technology company that provides real estate data analytics and business intelligence is expanding quickly and is planning to adopt a hybrid network that extends their system to AWS Cloud. They provide the latest real estate data to various websites and platforms as well as analytics and reports about the current state of the real estate industry.
With the huge volume of data that they have in their on-premises datacenter, they are looking for cloud-backed storage volumes that they canmount as Internet Small Computer System Interface (iSCSI) devices fromtheir on-premises application servers. Since the real estate industry is rapidly moving, their on-site analytics application is frequently accessing the latest data subsets locally while the old real estate data are rarely accessed.
As the Cloud Architect of the company, you are also required to minimize the need to scale the on-premises storage infrastructure while still providing the web application with low-latency access to the data.
Which type of AWS Storage Gateway service will you use to meet the above requirements?
File Gateway
Cached Volume Gateway
Tape Gateway
Stored Volume Gateway
