Font size
WorksheetsSC-01.6
Total questions: 50
Worksheet time: 38mins
Company XYZ has hired you as a Solutions Architect for their Flight Deals web application which is currently hosted on their on-premises data center. The website hosts high-resolution photos of top tourist destinations in the world and uses a third-party payment platform to accept payments.
Recently, they have heavily invested on their global marketing campaign and there is a high probability that the incoming traffic to their Flight Deals website will increase in the coming days.
Due to a tight deadline, the company does not have the time to fully migrate the website to AWS. A set of security rules that block common attack patterns, such as SQL injection and cross-site scripting should also be implemented to improve the website security.
Which of the following options will maintain the website's functionality despite the massive amount of incoming traffic?
Use CloudFront to cache and distribute the high-resolution images and other static assets of the website. Deploy AWS WAF on the Amazon CloudFront distribution to protect the website from common web attacks
Create and configure an S3 bucket as a static website hosting. Move the web domain of the website from your on-premises data center to Route 53 then route the newly created S3 bucket as the origin. Enable Amazon S3 server-side encryption with AWS Key Management Service managed keys
Use the AWS Server Migration Service to easily migrate the website from your on-premises data center to your VPC. Create an Auto Scaling group to automatically scale the web tier based on the incoming traffic. Deploy AWS WAF on the Amazon CloudFront distribution to protect the website from common web attacks
Generate an AMI based on the existing Flight Deals website. Launch the AMI to a fleet of EC2 instances with Auto Scaling group enabled, for it to automatically scale up or scale down based on the incoming traffic. Place these EC2 instances behind an ALB which can balance traffic between the web servers in the on-premises data center and the web servers hosted in AWS
A company is planning to launch a global e-commerce marketplace that will be accessible to multiple countries and regions. The Solutions Architect must ensure that the clients are protected from common web vulnerabilities as well as man-in-the-middle attacks to secure their sensitive financial information.
Which of the following is MOST secure setup that the Architect should implement in this scenario?
For the web domain registration, use Amazon Route 53 and enable Domain Name System Security Extensions (DNSSEC). Also use Amazon Route 53 for all DNS services. Use the AWS Certificate Manager (ACM) to register TLS/SSL certificates for the e-commerce marketplace then attach them on the Application Load Balancer. Configure the Server Name Identification extension in all user requests to the website
For the web domain registration, use Amazon Route 53 and then register a 2048-bit RSASHA256 encryption key from a third-party certificate service. Enable Domain Name System Security Extensions (DNSSEC) by using a 3rd party DNS provider that uses customer managed keys. Register the SSL certificates in ACM and attach them to the Application Load Balancer of the global e-commerce marketplace. Configure the Server Name Identification extension in all user requests to the website
For the web domain registration, use another DNS registry other than Amazon Route 53. Register a 2048-bit RSASHA256 encryption keys from a third-party certificate service. Enable Domain Name System Security Extensions (DNSSEC) by using a separate 3rd party DNS provider that uses customer managed keys. Use Amazon Route 53 to manage all DNS services. Register TLS/SSL certificates for the e-commerce marketplace using AWS Certificate Manager (ACM) then attach them to each Amazon EC2 instance. Configure the Server Name Identification extension in all user requests to the website
For the web domain registration, use Amazon Route 53 and enable Domain Name System Security Extensions (DNSSEC). Set up a BIND DNS server hosted in a Reserved EC2 instance for all DNS services. Use AWS Certificate Manager (ACM) to register TLS/SSL certificates for the e- commerce marketplace then attach them on the Application Load Balancer. Configure the Server Name Identification extension in all user requests to the website
A web application is composed of an Application Load Balancer and EC2 instances across three Availability Zones. During peak load, the web servers operate at 95% utilization. The system is set up to use Reserved Instances to handle steady state load and On-Demand Instances to handle the peak load. Your manager instructed you to review the current architecture and do the necessary changes to improve the system.
Which of the following provides the most cost-effective architecture to allow the application to recover quickly if an Availability Zone is unavailable during peak load?
Use a combination of Reserved and On-Demand instances on each AZ to handle both the steady state and peak load
Launch a Spot Fleet using a diversified allocation strategy, with Auto Scaling enabled on each AZ to handle the peak load instead of On- Demand instances. Retain the current set up for handling the steady state load
Launch an Auto Scaling group of Reserved instances on each AZ to handle the peak load. Retain the current set up for handling the steady state load
Use a combination of Spot and On-Demand instances on each AZ to handle both the steady state and peak load
You were just promoted as the IT Manager of a small, yet rapidly developing software consultancy company. Your CTO asked you to prepare the needed items in order to have a hybrid cloud architecture in which you must connect your on-premises network to AWS Cloud.
Which of the following will enable federated user access to the AWS Management Console? (Choose 2)
Create a SAML provider in your on-premises data center
Create an IAM user with Multi-Factor Authentication (MFA) for each employee of the software consultancy company
Create an IAM group with a set of IAM users for each employee of the software consultancy company
Create a SAML provider in IAM and create an IAM role that establishes a trust relationship between IAM and your organization's IdP that identifies your IdP as a principal (trusted entity) for purposes of federation
Inside your organization's network, you configure your identity store (such as Windows Active Directory) to work with a SAML-based identity provider (IdP) like Windows Active Directory Federation Services, Shibboleth, etc
A company is planning to build its new customer relationship management (CRM) portal in AWS. The application architecture will be using a containerized microservices hosted on an Amazon ECS cluster. A Solutions Architect has been tasked to set up the architecture and comply with the AWS security best practice of granting the least privilege. The architecture should also support the use of security groups and standard network monitoring tools at the container level to comply with the company’s strict IT security policies.
Which of the following provides the MOST secure configuration for the CRM portal?
Use the awsvpc network mode in the task definition in your Amazon ECS Cluster. Attach security groups to the ECS tasks then use IAM roles for tasks to access other resources
Use the bridge network mode in the task definition in your Amazon ECS Cluster. Attach security groups to the ECS tasks then use IAM roles for tasks to access other resources
Use the bridge network mode in the task definition in your Amazon ECS Cluster. Attach security groups to Amazon EC2 instances then use IAM roles for EC2 instances to access other resources
Use the awsvpc network mode in the task definition in your Amazon ECS Cluster. Attach security groups to the ECS tasks then pass IAM credentials into the container at launch time to access other AWS resources
An innovative Business Process Outsourcing (BPO) startup is planning to launch a scalable and cost-effective call center system using AWS. The system should be able to receive inbound calls from thousands of customers and generate user contact flows. Callers must have the capability to perform
basic tasks such as changing their password or checking their balance without them having to speak to a call center agent.
It should also have advanced deep learning functionalities such as automatic speech recognition (ASR) to achieve highly engaging user experiences and lifelike conversational interactions. A feature that allows the solution to query other business applications and send relevant data back to callers must also be implemented.
Which of the following is the MOST suitable solution that the Solutions Architect should implement?
Set up a cloud-based contact center using the Amazon Connect service. Create a conversational chatbot using Amazon Lex with automatic speech recognition and natural language understanding to recognize the intent of the caller then integrate it with Amazon Connect. Connect the solution to various business applications and other internal systems using AWS Lambda functions
Set up a cloud-based contact center using the AWS Ground Station service. Create a conversational chatbot using Amazon Alexa for Business with automatic speech recognition and natural language understanding to recognize the intent of the caller then integrate it with AWS Ground Station. Connect the solution to various business applications and other internal systems using AWS Lambda functions
Set up a cloud-based contact center using the Amazon Direct Connect service. Create a conversational chatbot using Amazon Rekognition with automatic speech recognition and natural language understanding to recognize the intent of the caller then integrate it with Amazon Direct Connect. Connect the solution to various business applications and other internal systems using AWS Lambda functions
A. Set up a cloud-based contact center using the AWS Elemental MediaConnect service. Create a conversational chatbot using Amazon Polly with automatic speech recognition and natural language understanding to recognize the intent of the caller then integrate it with AWS Elemental MediaConnect. Connect the solution to various business applications and other internal systems using AWS Lambda
functions
You are working as a Senior Solutions Architect for a leading accounting firm which conducts monthly performance checks of their Windows and Linux EC2 instances. They have more than 200 On-Demand EC2 instances running in their production environment and you were instructed to ensure that each instance has a logging feature that collects various system details such as memory usage, disk space, and other metrics. The system logs will be analyzed using AWS Analytics tools and the results will be stored to an S3 bucket.
Which of the following is the most efficient way to collect and analyze logs from the instances with minimal effort?
Set up and install the AWS Systems Manager Agent (SSM Agent) on each On-Demand EC2 instance which will automatically collect and push data to CloudWatch Logs. Analyze the log data with CloudWatch Logs Insights
Set up and configure a unified CloudWatch Logs agent in each On- Demand EC2 instance which will automatically collect and push data to CloudWatch Logs. Analyze the log data with CloudWatch Logs Insights
Install AWS SDK on each On-Demand EC2 instance and create a custom daemon script that would collect and push data to CloudWatch Logs periodically. Enable CloudWatch detailed monitoring and use CloudWatch Logs Insights to analyze the log data of all instances
Set up and install AWS Inspector Agent on each On-Demand EC2 instance which will collect and push data to CloudWatch Logs periodically. Set up a CloudWatch dashboard to properly analyze the log data of all instances
You are working as a Solutions Architect for Air France. The government requires every major airline institution, including your company, to perform a compulsory audit every year. An internal auditor from a major audit firm has been assigned to review your company's internal AWS services.
In this situation, what is the best solution that will provide the auditor the necessary access required to audit your services without compromising the security of your data?
Create an IAM user with full VPC access for the auditor but set a condition that will not allow any kind of modification if the request came from any IP other than his/her own
Give the auditor root access to the company's AWS services
Create an IAM user that is attached to an administrator role for the auditor. Also enable MFA to provide an additional level of security
Assign an IAM Role to the IAM user of the auditor and provide permissions for read-only access to the company's AWS services
A top university has launched its serverless online portal using Lambda and API Gateway in AWS that enables its students to enroll, manage their class schedule, and see their grades online. After a few weeks, the portal abruptly stopped working and lost all its data. The university hired an external cyber security consultant and based on the investigation; the outage was due to an SQL injection vulnerability on the portal's login page in which the attacker simply injected the malicious SQL code. You also need to track historical changes to the rules and metrics associated to your firewall.
Which of the following is the most suitable and cost-effective solution to avoid another SQL Injection attack against their infrastructure in AWS?
Use AWS WAF to add a web access control list (web ACL) in front of the Lambda functions to block requests that contain malicious SQL code. Use AWS Firewall Manager, to track changes to your web access control lists (web ACLs) such as the creation and deletion of rules including the updates to the WAF rule configurations
Create a new Application Load Balancer (ALB) and set up AWS WAF in the load balancer. Place the API Gateway behind the ALB and configure a web access control list (web ACL) in front of the ALB to block requests that contain malicious SQL code. Use AWS Firewall Manager to track changes to your web access control lists (web ACLs) such as the creation and deletion of rules including the updates to the WAF rule configurations
Use AWS WAF to add a web access control list (web ACL) in front of the API Gateway to block requests that contain malicious SQL code. Use AWS Config to track changes to your web access control lists (web ACLs) such as the creation and deletion of rules including the updates to the WAF rule configurations
Block the IP address of the attacker in the Network Access Control List of your VPC and then set up a CloudFront distribution. Set up AWS WAF to add a web access control list (web ACL) in front of the CloudFront distribution to block requests that contain malicious SQL code. Use AWS Config to track changes to your web access control lists (web ACLs) such as the creation and deletion of rules including the updates to the WAF rule configurations
A media company has a suite of internet-facing web applications hosted in US West (N. California) region in AWS. The architecture is composed of several On-Demand Amazon EC2 instances behind an Application Load Balancer, which is configured to use public SSL/TLS certificates.
The Application Load Balancer also enables incoming HTTPS traffic through the fully qualified domain names (FQDNs) of the applications for SSL termination. A Solutions Architect has been instructed to upgrade the corporate web applications to a multi-region architecture that uses various AWS Regions such as ap-southeast-2, ca-central-1, eu-west-3, and so forth.
Which of the following approach should the Architect implement to ensure that all HTTPS services will continue to work without interruption?
Use the AWS Certificate Manager service in the US West (N. California) region to request for SSL/TLS certificates for each FQDN which will be used to all regions. Associate the new certificates to the new Application Load Balancer on each new AWS Region that the Architect will add
In each new AWS Region, request for SSL/TLS certificates using the AWS Certificate Manager for each FQDN. Associate the new certificates to the corresponding Application Load Balancer of the same AWS Region
Use the AWS KMS in the US West (N. California) region to request for SSL/TLS certificates for each FQDN which will be used to all regions. Associate the new certificates to the new Application Load Balancer on each new AWS Region that the Architect will add
In each new AWS Region, request for SSL/TLS certificates using AWS KMS for each FQDN. Associate the new certificates to the corresponding Application Load Balancer of the same AWS Region
A new online banking portal has been recently deployed to an Auto Scaling group of EC2 instances on your VPC. However, after several days, you found out that there is an unusually high amount of inbound HTTP traffic coming from a set of 15 specific IP addresses from a certain country where your company has absolutely no customers. The EC2 instances are flooded with incoming requests that the system administrators cannot even establish an SSH connection to the instances.
What should a Solutions Architect do to fix this security vulnerability in the MOST cost-effective way?
Set up deny rules on your inbound Network Access control list associated with the web application tier subnet to block access to the group of attacking IP addresses
Use AWS WAF to protect your VPC against web attacks. Place the online banking portal behind a CloudFront RTMP distribution
Use AWS Shield Advanced to protect your VPC from common, most frequently occurring network and transport layer DDoS attacks
Create inbound rules in the Security Group of your EC2 instances to block the attacking IP addresses
Your team had developed an online voting application for a photo competition in AWS using CloudFormation. The application accepts high- quality images of each contestant and stores them in S3 then records the information about the image as well as the contestant's profile in RDS. After the competition, the CloudFormation stack is not used anymore and to save resources, the stack can be terminated. Your manager instructed you to back up the RDS database and the S3 bucket so the data can still be used even after the CloudFormation template is deleted.
Which of the following options is the MOST suitable solution to fulfill this requirement?
Set the DeletionPolicy to retain on both the RDS and S3 resource types on the CloudFormation template
Set the DeletionPolicy for the RDS instance to snapshot and then enable S3 bucket replication on the source bucket to a destination bucket to maintain a copy of all the S3 objects
Set the DeletionPolicy on the RDS resource to snapshot and set the S3 bucket to retain
Set the DeletionPolicy on the S3 bucket to snapshot
You are working as a Solutions Architect for a credit company. They are
running a customer analytics web application in AWS and your data analytics department has asked you to add a reporting tier to the application. This new component will aggregate and publish status reports every hour from user-generated information that is being stored in a Multi-AZ RDS MySQL database instance. The RDS instance is configured with ElastiCache as a database caching layer between the application tier and database tier.
How do you implement a reporting tier with as little impact to your database as possible?
Generate the reports by querying the ElastiCache database caching tier. Use Kibana to visualize the reports
Query the synchronously replicated standby RDS MySQL instance maintained through Multi-AZ and generate the report from the results. Use Kibana to visualize the reports
Launch an RDS Read Replica linked to your Multi AZ master database and generate reports from the Read Replica. Use QuickSight to visualize the reports
Continuously send transaction logs from your master database to an S3 bucket and use S3 byte range requests to generate the reports off the S3 bucket. Use QuickSight to visualize the reports
You are working as a Senior Solutions Architect in a technology company and you have just created a new S3 bucket called mycompany" in us-west-2 AWS region. You have enabled static website hosting and uploaded the static web content files in the S3 bucket including the index.html file. You registered a custom domain name called www.mycompany.com using Route 53 to connect it with the S3 bucket.
The next day, a new record set has been created which points to the S3website endpoint: http://mycompany.s3-website-us-west-2.amazonaws.com but when you tried to access the website, you cannot seeanycontent.Youtriedgoingtomycompany.comandwww.mycompany.com but neither of these links work properly.
Which of the following is the MOST likely cause of this issue that the Architect should fix?
The site does not work because you have not set a value for the error.html file, which is a required step
The site will not work because the URL does not include a file name at the end. This means that you need to use this URL instead: www.mycompany.com/index.html
Route 53 is still propagating the domain name changes. Wait for another 12 hours and then try again
The S3 bucket does not have public read access which blocks the website visitors from seeing the content
You deployed an online registration system which is hosted on a fleet of auto-scaled Spot EC2 instances. It is using an RDS database and its Auto Scaling group is associated with an Elastic Load Balancer (ELB). You noticed that the EC2 instances launched via the Auto Scaling group are being marked unhealthy, but these instances are not being terminated. In this scenario, what would you do to ensure that the instances marked as unhealthy by the ELB will be terminated and replaced automatically?
Increase the value for the Health check interval set on the Elastic Load Balancer
Change the health check type of your Auto Scaling Group to ELB
Enable the Proxy Protocol in the ELB
Use CloudWatch to monitor the EC2 instances
You are working as an IT Consultant for one of the Big 4 accounting firms with multiple VPCs in various regions. As part of their security compliance, you need to set up a logging solution to track all the changes made to their AWS resources in all regions, which host their enterprise accounting system such as EC2, S3, CloudFront and IAM.
The logging solution must ensure the security, integrity, and durability of your log data in order to pass the compliance requirements. In addition, it should provide an event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and API calls.
In this scenario, which of the following options is the best solution to use?
Create a new CloudWatch trail in a new S3 bucket using the AWS CLI and pass both the--is-multi-region-trail and --include-global-service- eventsparameters then encrypt log files using KMS encryption. Enable Multi Factor Authentication (MFA) Delete on the S3 bucket and ensure that only authorized users can access the logs by configuring the bucket policies
Create a new CloudWatch trail in a new S3 bucket using the CloudTrail console and pass the--is-multi-region-trailparameter then encrypt log files using KMS encryption. Enable Multi Factor Authentication (MFA) Delete on the S3 bucket and ensure that only authorized users can access the logs by configuring the bucket policies
Create a new CloudTrail trail in a new S3 bucket using the AWS CLI and pass the--is-multi-region-trailparameter then encrypt log files using KMS encryption. Enable Multi Factor Authentication (MFA) Delete on the S3 bucket and ensure that only authorized users can access the logs by configuring the bucket policies
Create a new CloudTrail trail in a new S3 bucket using the AWS CLI and pass both the--is-multi-region-trail and --include-global-service- eventsparameters then encrypt log files using KMS encryption. Enable Multi Factor Authentication (MFA) Delete on the S3 bucket and ensure that only authorized users can access the logs by configuring the bucket policies
Your company has just launched a new central employee registry server which contains all the public employee registration information of each staff in the company. The management teams from other departments who have their servers located in different VPC's need to connect to the central repository server to continue their work.
How will you implement the new architecture of the new server given these circumstances?
Set up an IPSec Tunnel between the central server VPC and each of the teams' VPCs
Use AWS Direct Connect to create a dedicated connection between the central server VPC and each of the teams' VPCs
None of the above options are correct
Link each of the teams' VPCs to the central server VPC using VPC Peering
A government agency has multiple VPCs in various AWS regions across the United States that need to be linked up to an on-premises central office network in Washington, D.C. The central office requires inter-region VPC access over a private network that is dedicated to each region for enhanced security and more predictable data transfer performance. Your team is tasked to quickly build this network mesh and to minimize the management overhead to maintain these connections.
Which of the following options is the most secure, highly available, and durable solution that you should use to set up this kind of interconnectivity?
Enable inter-region VPC peering which allows peering relationships to be established between VPCs across different AWS regions. This will ensure that the traffic will always stay on the global AWS backbone and will never traverse the public Internet
Utilize AWS Direct Connect Gateway for inter-region VPC access. Create a virtual private gateway in each VPC, then create a private virtual interface for each AWS Direct Connect connection to the Direct Connect gateway
Implement a hub-and-spoke network topology in each region that routes all traffic through a network transit center using AWS Transit Gateway. Route traffic between VPCs and the on-premise network over AWS Site-to-Site VPN
Create a link aggregation group (LAG) in the central office network to aggregate multiple connections at a single AWS Direct Connect endpoint in order to treat them as a single, managed connection. Use AWS Direct Connect Gateway to achieve inter-region VPC access to all your AWS resources. Create a virtual private gateway in each VPC and then create a public virtual interface for each AWS Direct Connect connection to the Direct Connect Gateway
A tech startup is planning to launch a new global mobile marketplace using AWS Amplify and AWS Mobile Hub. To lower the latency, the backend APIs will be launched to multiple AWS regions to process the sales and financial transactions on the region closest to the users. You are instructed to design the system architecture to ensure that the transactions made in one region are automatically replicated to other regions. In the coming months ahead, it is expected that the marketplace will have millions of users across North America, South America, Europe, and Asia.
Which of the following is the most scalable, cost-effective and highly available architecture that you should implement?
Create a Global DynamoDB table by choosing your preferred AWS region, enabling the DynamoDB Streams option and creating replica tables in the other AWS regions where you want to replicate your data. In each local region, store the individual transactions to a DynamoDB replica table in the same region
Create an Amazon Aurora Multi-Master database on all required regions. Store the individual transactions to the Amazon Aurora instance in the local region. Replicate the transactions table between regions using Aurora replication. In this set up, any changes made in one of the tables will be automatically replicated across all other tables
Create a Global DynamoDB table in your preferred region which will automatically create new replica tables on all AWS regions. In each local region, store the individual transactions to a DynamoDB replica table in the same region. Any changes made in one of the replica tables will be automatically replicated across all other tables
In each local region, store the individual transactions to a DynamoDB table. Set up an AWS Lambda function to read recent writes from the table and replay the data to DynamoDB tables in all other regions
A company that provides cloud-based accounting and management solutions to various clients recently identified a series of infrastructure layer attacks to their VPC such as SYN floods, UDP floods, and other DDoS attacks. As the Solutions Architect, you are required to fortify the security of their current cloud infrastructure to protect the data of your clients and ensure that you will get an immediate notification for any ongoing DDoS attacks via CloudWatch.
You also must set up a system that will continuously monitor and record your AWS resource configurations and will allow you to automate the evaluation of recorded configurations against the desired configurations of your company.
Which of the following services should you use to meet the above requirement? (Choose 2)
AWS WAF
AWS Shield Advanced
AWS Firewall Manager
AWS Systems Manager
AWS Config
A company has created multiple accounts in AWS to support the rapid growth of its cloud services. The multiple accounts are used to separate their various departments such as finance, human resources, engineering, and many others. Each account is managed by a Systems Administrator which has the root access for that specific account only. There is a requirement to centrally manage policies across multiple AWS accounts by allowing or denying AWS services for individual accounts, or for groups of accounts.
Which is the most suitable solution that you should implement with the LEAST amount of complexity?
Use AWS Organizations and Service Control Policies to control the list of AWS services that can be used by each member account
Set up AWS Organizations and Organizational Units (OU) to connect all AWS accounts of each department. Create custom IAM Policy to allow or deny the use of certain AWS services for each account
Connect all departments by setting up a cross-account access to each of the AWS accounts of the company. Create and attach IAM policies to your resources based on their respective departments to control access
Provide access to externally authenticated users via Identity Federation. Set up an IAM role to specify permissions for users from each department whose identity is federated from your organization or a third-party identity provider
Last year, the big four banks in your country have collaborated to create a simple-to-use, mobile payment app that enables the users to easily transfer money and pay bills without the hassle of logging in to their online banking, entering the account details of the other party and spending time going through other security verification processes. With their mobile payment app, anyone can easily pay another person, split the bill with their friends or pay for their coffee in an instant with just a few taps in the app.
The payment app is available on both Android and iOS devices, including a web portal that is deployed in AWS using OpsWorks Stacks and EC2 instances. It was a big success with over 5 million users nationwide and has over 100 transactions every hour. After one year, a new feature that will enable the users to store their credit card information in the app is ready to be added to the existing web portal.
However, due to PCI-DSS compliance, the new version of the APIs and web portal cannot be deployed to the existing application stack. As the Solutions Architect of this project, how would you deploy the new web portal for the mobile app without having any impact to your 5 million users?
Forcibly upgrade the existing application stack in Production to be PCI- DSS compliant. Once done, deploy the new version of the web portal on the existing application stack
Deploy a new OpsWorks stack that contains a new layer with the latest web portal version. Shift traffic between existing stack and new stack, running different versions of the web portal using Blue/Green deployment strategy by using Route53. Route only a small portion of incoming production traffic to use the new application stack while maintaining the old application stack. Check the features of the new portal; once it's 100% validated, slowly increase incoming production traffic to the new stack. If there are issues on the new stack, change Route53 to revert to old stack
Deploy the new web portal using a Blue/Green deployment strategy with AWS CodeDeploy and Lambda in which the green environment represents the current web portal version serving production traffic while the blue environment is staged in running a different version of the web portal
Create a new stack that contains the latest version of the web portal. Using Route 53 service, direct all the incoming traffic to the new stack at once so that all the customers get to access new features
You have a production, development, and test environments in your software development department, and each environment contains tens to hundreds of EC2 instances, along with other AWS services. Recently, Ubuntu released a series of security patches for a critical flaw that was detected in their OS. Although this is an urgent matter, there is no guarantee yet that these patches will be bug-free and production-ready hence, you must immediately patch all your affected EC2 instances in all the environments, except for the production environment.
The EC2 instances in the production environment will only be patched after you have verified that the patches work effectively. Each environment also has different baseline patch requirements that you will need to satisfy.
Using the AWS Systems Manager service, how should you perform this task with the least amount of effort?
Schedule a maintenance period in AWS Systems Manager Maintenance Windows for each environment, where the period is after business hours so as not to affect daily operations. During the maintenance period, Systems Manager will execute a cron job that will install the required patches for each EC2 instance in each environment. After that, verify in Systems Manager Managed Instances that your environments are fully patched and compliant
Tag each instance based on its environment and OS. Create a patch baseline in AWS Systems Manager Patch Manager for each environment. Categorize EC2 instances based on their tags using Patch Groups and apply the patches specified in the corresponding patch baseline to each Patch Group
Tag each instance based on its environment and OS. Create various shell scripts for each environment that specifies which patch will serve as its baseline. Using AWS Systems Manager Run Command, place the EC2 instances into Target Groups and execute the script corresponding to each Target Group
Tag each instance based on its OS. Create a patch baseline in AWS Systems Manager Patch Manager for each environment. Categorize EC2 instances based on their tags using Patch Groups and then apply the patches specified in the corresponding patch baseline to each Patch Group. Afterwards, verify that the patches have been installed correctly using Patch Compliance. Record the changes to patch and association compliance statuses using AWS Config
You are working for the country's biggest stock exchange as a Solutions Architect. Due to the nature of their financial operations, it is required that all their trading applications must be highly available and fault tolerant. They have auto-scaled On-Demand EC2 instances which are deployed to two separate Availability Zones with an Elastic Load Balancing and an Amazon RDS instance configured with Multi-AZ configuration.
In this scenario, what is the type of replication that occurs between the instances when configuring an RDS environment for Multi-AZ in a region?
Asynchronous replication
Synchronous replication
Cross-Region Replication (CRR)
Snapshot replication
You are setting up a storage solution which will be accessed by over a thousand Linux servers across multiple availability zones. The storage service should maintain high performance and high durability while being able to handle rapidly changing data. In addition, it should also be highly available whenever the servers are fetching and storing data to it, with minimal management overhead.
You are also required to choose a configuration management service which will ensure that all your EC2 instances are bootstrapped with a specific analytics software at start-up.
Which of the following is the most cost-effective choice that you should use to meet the above requirement?
Use EFS as the storage solution and the Systems Manager Session Manager as the configuration management service
Create a new S3 bucket and use it as the storage solution. Use the Systems Manager State Manager as the configuration management service
Use EFS as the storage solution and the Systems Manager State Manager as the configuration management service
Create a new S3 bucket and use it as the storage solution. Use the Systems Manager Patch Manager as the configuration management service
An advertising firm is required to analyze the clickstream data of all their websites in real time. The data will be used for clickstream analysis which contains the pages that the user visits and the sequential stream of clicks they create as they move across the website.
Which of the following options will fulfill this requirement in AWS?
Collect the clickstreams from the websites and store to an S3 bucket. Analyze the data with AWS Lambda
Push the clickstream data by session to an Amazon Kinesis stream and then analyze the data by using Amazon Kinesis workers
Send the clickstream data directly to a DynamoDB table and then create a custom application using Elastic Beanstalk that fetches the data from the table and analyzes the clickstream
Send the clickstream data by user session to an Amazon SQS queue which buffers the data to a Multi-AZ RDS database. Create and deploy a custom application to a large EC2 instance that analyzes the data in RDS
Your organization is looking to quickly migrate their legacy system to AWS and be able to scale it to meet their business needs. Optimization of the existing application and its components is out of the question since they don't have the budget and the time to accommodate these changes.
However, they are planning to re-architect their systems once these components are already migrated and running properly in the cloud.
Which of the following migration strategies is the most suitable one to execute in this scenario?
Repurchase
Replatform
Rehost
Refactor / Re-architect
An unusual API activity and intra-VPC port scanning have been identified by the security team of your department. They noticed that there are multiple
port scans being triggered to your EC2 instances from a specific IP address. To fix the issue immediately, your team has decided to simply block the offending IP address. You are also instructed to fortify their existing cloud infrastructure security from the most frequently occurring network and transport layer DDoS attacks.
Which of the following is the most suitable method to satisfy the above requirement in AWS?
Deny access from the IP Address block by adding a specific rule to all the Security Groups. Use a combination of AWS WAF and AWS Config to protect your cloud resources against common web attacks
Deny access from the IP Address block in the Network ACL. Use AWS Shield Advanced to protect your cloud resources
Block the offending IP address using Route 53. Use Amazon Macie to automatically discover, classify, and protect sensitive data in AWS, including DDoS attacks
Change the Windows Firewall settings to deny access from the IP address block. Use Amazon GuardDuty to detect potentially compromised instances or reconnaissance by attackers, and AWS Systems Manager Patch Manager to properly apply the latest security patches to all your instances
You are working for the leading fast food chain in the country as a Technical Specialist. They have a legacy delivery website which can still be accessed publicly via the world wide web and is hosted on a virtual machine hosted in their on-premises VMware vCenter Server which uses the latest version.
As part of their digital transformation program, they decided to adopt a hybrid cloud architecture that connects their data center to AWS and hence, you are instructed to migrate their legacy delivery website to AWS. Once migrated, the VM should be available as a ready-to-use Amazon machine image (AMI).
Which of the following is the most suitable method to do the migration as well as to support incremental updates of changing VMs?
Use the Amazon Mechanical Turk for the migration process
Use the AWS Management Portal for vCenter to simplify the migration of your VMs from the on-premises VMware vCenter to AWS
Deploy the AWS Server Migration Service Connector virtual appliance on your on-premises VMware vCenter environment and use the AWS Server Migration Service for the migration process
Use AWS VM Import/Export for the migration process
The department of education just recently decided to leverage on AWS cloud infrastructure to supplement their current on-premises network. They are building a new learning portal that teaches kids basic computer science concepts and provides innovative gamified courses for teenagers where they can gain higher rankings, power-ups and badges.
A Solutions Architect is instructed to build a highly available cloud infrastructure in AWS with multiple Availability Zones. The department wants to increase the application’s reliability and gain actionable insights using application logs. A Solutions Architect needs to aggregate logs, automate log analysis for errors and immediately notify the IT Operations team when errors breached a certain threshold.
Which of the following is the MOST suitable solution that the Architect should implement?
Download and install the Amazon CloudWatch agent in the on- premises servers and send the logs to Amazon CloudWatch Logs. Create a metric filter in CloudWatch to turn log data into numerical metrics to identify and measure application errors. Create a CloudWatch Alarm that monitors the metric filter and immediately notify the IT Operations team for any issues
Download and install the AWS X-Ray agent in the on-premises servers and send the logs to AWS Lambda to turn log data into numerical metrics that identify and measure application errors. Store the metrics data in Systems Manager Parameter Store. Create a CloudWatch Alarm that monitors the metric and immediately notify the IT Operations team for any issues
Download and install the Amazon Kinesis agent in the on-premises servers and send the logs to Amazon CloudWatch Logs. Create a metric filter in CloudWatch to turn log data into numerical metrics to identify and measure application errors. Use Amazon QuickSight to monitor the metric filter in CloudWatch and immediately notify the IT Operations team for any issues
Download and install the Amazon CloudWatch agent in the on- premises servers and send the logs to Amazon CloudWatch Events. Create a metric filter in CloudWatch to turn log data into numerical metrics to identify and measure application errors. Use Amazon Athena to monitor the metric filter and immediately notify the IT Operations team for any issues
An online delivery system, hosted in a fleet of EC2 instances, is deployed in multiple Availability Zones in the ap-southeast-1 region with an Application Load Balancer that evenly distributes the load. The system is using a MySQL RDS instance to store the deliveries and transactions of the system.
To ensure business continuity, you are instructed to set up a disaster recovery system in which the RTO must be less than 3 hours and the RPO is 15 minutes when a system outage occurs. A system should also be implemented that can automatically discover, classify, and protect any personally identifiable information (PII) or intellectual property in your data store.
As the Solutions Architect, which disaster recovery strategy should you use to achieve the required RTO and RPO targets in the most cost-effective manner?
Schedule 15-minute DB backups to Amazon Glacier. Store the transaction logs to an S3 bucket every 5 minutes. Use Amazon Macie to automatically discover, classify, and protect your sensitive data
Schedule a database backup to an S3 bucket every hour and store transaction logs to a separate S3 bucket every 5 minutes. Use Amazon Macie to automatically discover, classify, and protect your sensitive data
Set up asynchronous replication in the database using a Multi-AZ deployments configuration. Use AWS Shield to automatically discover, classify, and protect any personally identifiable information (PII) or intellectual property from your RDS database
Schedule a database backup to AWS Storage Gateway every hour and store transaction logs to a separate S3 bucket every 5 minutes. Use AWS Shield to automatically discover, classify, and protect any personally identifiable information (PII) or intellectual property on your Storage Gateway
You are working as a Solutions Architect for a leading food manufacturing company in Asia which is planning to launch a new online distributor portal that will provide access to thousands of food distributors in the region. The new web portal will be hosted on a fleet of 10 on-demand EC2 web server instances and the custom web domain name has already been registered using Route53 in your AWS account. Which of the following options will ensure that the incoming web traffic to the portal are uniformly distributed to all EC2 instances?
1. Launch a new CloudFront distribution with an origin that is pointed to the list of private IP addresses of the EC2 instance. 2. Configure a Route53 CNAME record to your CloudFront distribution
1. Launch a new Elastic Load Balancer (ELB). 2. Place all the EC2 instances behind the ELB. 3. Set a Route53 A Record to point to the DNS name of the ELB
1. Launch a new Elastic Load Balancer (ELB). 2. Attach a new EIP to the ELB. 3. Place all the EC2 instances behind the ELB. 4. In Route53, create an A record that points to the EIP of the ELB
1. Launch a new Elastic Load Balancer (ELB). 2. Place all the EC2 instances behind the ELB. 3. In Route53, create an alias record that points to your ELB
You are working as a Cloud Engineer for an IoT start-up company which is developing a health monitoring pet collar for dogs and cats. The company has hired an electrical engineer to build a smart pet collar that collects biometric information of the pet every second and then sends it to a web portal through a POST API request. Your task is to architect the API services and the web portal which will accept and process the biometric data as well as provide complete trends and health reports to the pet owners. The portal should be highly durable, available, and scalable with an additional feature for showing real-time biometric data analytics.
Which of the following is the best architecture to meet the above requirement?
1. Create an SQS queue to collect the incoming biometric data. 2. Analyze the data from SQS with Amazon Kinesis. 3. Store the results to RDS
1. Launch an Elastic MapReduce instance to collect the incoming biometrics data. 2. Use Amazon Kinesis to analyze the data. 3. Save the results to DynamoDB
1. Create an S3 bucket to collect the incoming biometric data from the smart pet collar. 2. Use Data Pipeline to run a data analysis task in the S3 bucket every day. 3. Use Redshift as the online analytic processing (OLAP) database for the web portal
1. Use Amazon Kinesis Data Streams to collect the incoming biometric data. 2. Analyze the data using Kinesis and show the results in real-time dashboard. 3. Set up a simple data aggregation process and pass the results to Amazon S3. 4. Store the data to Redshift, configured with automated backups, to handle complex analytics
In your on-premises data center, you have a multi-tiered supply chain application which is using trusted IP addresses that your 3rd party vendors have whitelisted in their network. As the Solutions Architect of the company, you are responsible to migrate the application to your VPC in AWS without requiring your vendors to change their IP address whitelists. This must be done in the most cost-effective manner.
Which of the following is the BEST solution that the Architect should implement to meet the above requirement?
Create multiple Elastic IP addresses to map the whitelisted IP address range in your on-premises network
Create and configure a CloudFront web distribution with an IP match condition and use AWS WAF to whitelist a specific IP address range in your VPC
Create Elastic IP addresses from your Bring Your Own IP (BYOIP) address prefix and use them with AWS resources such as EC2 instances, Network Load Balancers, and NAT Gateways
Create a Route Origin Authorization (ROA) document through your Domain Name Registrar. Afterwards, provision and advertise your whitelisted IP address range to your AWS account
An international foreign exchange company has a serverless forex trading application which was built using AWS SAM and is hosted on AWS Serverless Application Repository. They have millions of users worldwide who use their online portal 24/7 to trade currencies. However, they are receiving a lot of complaints that it takes a few minutes for their users to login to their portal lately, including occasional HTTP 504 errors. As the Solutions Architect, you are tasked to optimize the system and to significantly reduce the time to login to improve the customers' satisfaction.
Which of the following should you implement in order to improve the performance of the application with minimal cost? (Choose 2)
Deploy your application to multiple AWS regions to accommodate your users around the world. Set up a Route 53 record with latency routing policy to route incoming traffic to the region that provides the best latency to the user
Set up multiple and geographically disperse VPCs to various AWS regions then create a transit VPC to connect all your resources. Deploy the Lambda function in each region using AWS SAM, in order to handle the requests faster
Set up an origin failover by creating an origin group with two origins. Specify one as the primary origin and the other as the second origin which CloudFront automatically switches to when the primary origin returns specific HTTP status code failure responses
Increase the cache hit ratio of your CloudFront distribution by configuring your origin to add a Cache-Control max-age directive to your objects and specify the longest practical value for max-age
Use Lambda@Edge to allow your Lambda functions to customize content that CloudFront delivers and to execute the authentication process in AWS locations closer to the users
A telecommunications company is planning to host a WordPress website on
an Amazon ECS Cluster which uses the Fargate launch type. For security purposes, the database credentials should be provided to the WordPress image by using environment variables. Your manager instructed you to ensure that the credentials are secure when passed to the image and that they cannot be viewed on the cluster itself. The credentials must be kept in a dedicated storage with lifecycle management and key rotation.
Which of the following is the most suitable solution in this scenario that you can implement with the least effort?
In the ECS task definition file of the ECS Cluster, store the database credentials using Docker Secrets to centrally manage this sensitive data and securely transmit it to only those containers that need access to it. Secrets are encrypted during transit and at rest. A given secret is only accessible to those services which have been granted explicit access to it via IAM Role, and only while those service tasks are running
Store the database credentials using the AWS Systems Manager Parameter Store and then encrypt them using AWS KMS. Create an IAM Role for your Amazon ECS task execution role and reference it with your task definition, which allows access to both KMS and the Parameter Store. Within your container definition, specify secrets with the name of the environment variable to set in the container and the full ARN of the Systems Manager Parameter Store parameter containing the sensitive data to present to the container
In the ECS task definition file of the ECS Cluster, store the database credentials and encrypt with KMS. Store the task definition JSON file in a private S3 bucket and ensure that HTTPS is enabled on the bucket to encrypt the data in-flight. Create an IAM role to the ECS task definition script that allows access to the specific S3 bucket and then pass the -- cli-input-json parameter when calling the ECS register-task-definition. Reference the task definition JSON file in the S3 bucket which contains the database credentials
Store the database credentials using the AWS Secrets Manager and then encrypt them using AWS KMS. Create an IAM Role for your Amazon ECS task execution role and reference it with your task definition which allows access to both KMS and AWS Secrets Manager Within your container definition, specify secrets with the name of the environment variable to set in the container and the full ARN of the Secrets Manager secret which contains the sensitive data, to present to the container
A multinational research institute has an urgent requirement to migrate 2 PB of genomic data to AWS in about a week. This is because their data center has been recently struck by a massive magnitude 8 earthquake and the building has been badly damaged, although still operational. They have a 100 Mbps Internet line but the connection is intermittent due to the damages in the electrical grid.
In this scenario, what is the most suitable service to use to migrate the data to AWS?
Set up a hybrid network by launching a Direct Connect connection between your on-premises data center and your AWS Cloud. Use the AWS Server Migration Service to simplify and automate the migration of your data located on your on-premises storage
Use multiple AWS Snowball appliances to transfer the data to AWS Cloud
Set up a File Gateway using the Amazon Storage Gateway, to connect your data center and your VPC. Once the connection has been established, upload all your data to AWS
Upload the data to S3 using the Multipart Upload API and enable the S3 Transfer Acceleration to expedite the process
You are working as a Solutions Architect for a leading media company that stores their video animations in several S3 buckets. To protect the digital assets of the company, you were instructed to set up a monitoring system that will notify the IT Operations team if there are any buckets that allow public read or public write access. The team will then liaise with the compliance team if the bucket is indeed intended to be accessed publicly.
Which of the following is the MOST suitable solution that you can do in order to meet this requirement?
Enable Amazon S3 Block Public Access with BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets settings
Enable AWS Config to monitor the S3 bucket ACLs and policies for compliance violations. Create an IAM Role and Policy that grants a Lambda function permission to read S3 bucket policies and send alerts through SNS. Create and configure a CloudWatch Events rule that triggers Lambda when AWS Config detects a policy violation. Create a Lambda function that uses the IAM role to review S3 bucket ACLs and policies and notify the IT Operations team of out-of-compliance policies
Enable AWS Organizations and set up a Service Control Policy that will restrict all users to upload public objects to the S3 bucket. Set up a Lambda function and an SNS topic that will notify the IT Operations team if there is an attempt made by a user to upload a public object
Use the s3-bucket-public-read-prohibited and s3-bucket-public-write- prohibited managed rules in AWS Config that will automatically notify the IT Operations team if someone uploaded publicly accessible and writable files to the S3 bucket
A company is using AWS Organizations to manage their multi-account and multi-region AWS infrastructure. They are currently doing large-scale automation for their key daily processes to save costs. One of these key processes is sharing specified AWS resources, which an organizational account owns, with other AWS accounts of the company using AWS RAM.
There is already an existing service which was previously managed by a separate organization account moderator, who also maintained the specific configuration details.
In this scenario, what could be a simple and effective solution that would allow the service to perform its tasks on the organization accounts on the moderator's behalf?
Use trusted access by running the enable-sharing-with-aws- organization command in the AWS RAM CLI. Mirror the configuration changes that was performed by the account that previously managed this service
Enable cross-account access with AWS Organizations in the Resource Access Manager Console. Mirror the configuration changes that was performed by the account that previously managed this service
Configure a service-linked role for AWS RAM and modify the permissions policy to specify what the role can and cannot do. Lastly, modify the trust policy of the role so that other processes can utilize AWS RAM
Attach an IAM role on the service detailing all the allowed actions that it will be able to perform. Install an SSM agent in each of the worker VMs. Use AWS Systems Manager to build automation workflows that involve the daily key processes
A legacy web application, which is composed of an Auto Scaling group of EC2 instances and an Application Load Balancer, will be decommissioned soon.
You are tasked to set up a new serverless architecture that comprises of AWS Lambda, API Gateway, and DynamoDB. In addition, you are also required to build a CI/CD pipeline to automate the build process and support gradual deployments.
Which is the most suitable way to build, test, and deploy your new architecture in AWS?
Set up a CI/CD pipeline using CodeCommit, CodeBuild, CodeDeploy, and CodePipeline to build the CI/CD pipeline then use AWS Systems Manager Automation to automate the build process and support gradual deployments
Use the AWS Serverless Application Repository to organize related components, share configuration such as memory and timeouts between resources, and deploy all related resources together as a single, versioned entity
Use AWS Serverless Application Model (AWS SAM) and set up AWS CodeBuild, AWS CodeDeploy, and AWS CodePipeline to build a CI/CD pipeline
Use CloudFormation and OpsWorks for your build, deployment, and configuration management service
You recently launched an On-Demand EC2 instance in a custom VPC with a private hosted zone configured in your Route 53. However, you noticed that the instance does not have a public DNS hostname when you used the EC2 console or the AWS CLI. You also noticed that the instance cannot resolve Amazon-provided private DNS hostnames.
As the Solutions Architect, how can you solve this issue?
Modify the enableDnsHostNames attribute of your VPC to true and the enableDnsSupport attribute to false
Modify the enableDnsHostNames attribute of your VPC to false and the enableDnsSupportattribute to true
Modify the enableDnsHostNames attribute of your VPC to false and the enableDnsSupport attribute to false
Modify the enableDnsHostNames attribute of your VPC to true and the enableDnsSupport attribute to true
As a Solutions Architect in a top IT consultancy firm, your role is to implement a reliable and highly available system that can recover from infrastructure or service disruptions. In addition, it should dynamically acquire computing resources to meet demand and mitigate service disruptions such as misconfigurations or transient network issues.
Which of the following is the most suitable option that you can implement to satisfy the above requirement?
Scale horizontally to increase aggregate system availability. Replace one large resource with multiple small resources to reduce the impact of a single failure on the overall system. Distribute requests across multiple, smaller resources to ensure that they don’t share a common point of failure. Implement Auto-Scaling on your EC2 instances and utilize multiple Availability Zones. Clone your stack to another AWS Region and implement a Route 53 failover routing policy
Ensure that there is a detailed logging available which contains the important content, such as file access, error logs, and other changes
Use serverless architecture which eliminates the need for you to run and maintain servers or carry out traditional compute activities
Use managed and application level services to reduce cost of ownership
You are the Lead Solutions Architect for an IT consulting firm which has various teams and departments that have been grouped into several organizational units (OUs) using AWS Organizations. You received a report from the security team that there was a suspected breach in your environment where a third-party AWS account was suddenly added to your organization without any prior approval. The external account has high level access privileges to the accounts that you own but luckily, no detrimental action was performed.
What should you do to properly set up a monitoring system than notifies you for any changes to your AWS accounts? (Choose 2)
Use AWS Config to monitor the compliance of your AWS Organizations. Set up an SNS Topic or CloudWatch Events that will send alerts to you for any changes
Set up a CloudWatch Dashboard to monitor any changes to your organizations and create an SNS topic that would send you a notification
Create a trail in Amazon CloudTrail to capture all API calls to your AWS Organizations, including calls from the AWS Organizations console and from code calls to the AWS Organizations APIs. Use CloudWatch Events and SNS to raise events when administrator-specified actions occur in an organization and send a notification to you
Provision an AWS-approved third-party monitoring tool from the AWS Marketplace that would send alerts if a breach was detected. Use AWS GuardDuty to analyze any possible breach and notify the administrators using AWS SNS
Monitor all changes to your organization using Systems Manager and use CloudWatch Events to notify you for any new activity to your account
You are working as a Solutions Architect for an online sports betting company in Melbourne, Australia which uses a large on-demand EC2 instance to host its online betting platform. To ensure redundancy, your manager instructed you to migrate the large on-demand EC2 instance from one region to another and use its same PEM key which was generated using the Amazon EC2 console. How can you satisfy this requirement?
Key pairs are not stored per region. All the keys in your AWS account are available globally
Migrate the instance to a new region by copying the AMI of the EC2 instance to the new region and importing the private key
Copy the AMI of your EC2 machine to your new region and start up an instance using the AMI
Transfer your key to different regions using the EC2-copy-key API
A game development startup hired you to design the cloud architecture of an online role-playing game, which has an extra leaderboard that displays the top 10 scorers of the day. The leaderboard is updated real-time using Redis sorted sets which sorts and re-ranks the data. In case of an outage, a Lambda function can re-generate all the data to the cluster. A Solutions Architect is instructed to build a cost-effective and fault tolerant caching layer that enhances the data durability of your ElastiCache cluster.
Which of the following is the MOST suitable and cost-effective solution that the Architect must implement to meet the above requirement?
Integrate your ElastiCache with Amazon ES then enable Kibana and LogStash to re-generate all the data to the Amazon ElastiCache cluster in the event of an outage
Purchase extra-large reserved nodes for your new ElastiCache Redis cluster and enable the Multi-AZ with Auto-Failover option upon launch
Use the Redis append-only file feature (AOF) to record all the commands that change cache data to an append-only file. When a node is rebooted and the cache engine starts, the AOF is "replayed" and the result is a warm Redis cache with all the data intact
Enable automatic backups and set the backup retention period to maximum
You are working as a Solutions Architect for a leading media company. There is a requirement to copy information to or from the shared resource in the other AWS account. You must provide the other account access to several AWS resources such as S3, KMS and Amazon ES, in the form of a list of AWS account ID numbers. In addition, the user in the other account should still work in the trusted account and there is no need to give up his or her user permissions in place of the role permissions. You must also set up a solution that continuously assess, audit, and monitor the policy configurations.
Which of the following is the MOST suitable type of policy that you should use in this scenario?
Set up a service-linked role with an identity-based policy. Use AWS Systems Manager rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration
Set up cross-account access with a resource-based Policy. Use AWS Config rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration
Set up a service-linked role with a service control policy. Use AWS Systems Manager rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration
Set up cross-account access with a user-based policy configuration. Use AWS Config rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration
A company has recently adopted a hybrid cloud architecture which requires them to migrate their databases from their on-premises data center to AWS. One of their applications requires a heterogeneous database migration in which they need to transform their on-premises Oracle database to PostgreSQL. A schema and code transformation should be done first in order to successfully migrate the data.
Which of the following options is the most suitable approach to migrate the database in AWS?
Use a combination of AWS Data Pipeline service and CodeCommit to convert the source schema and code to match that of the target PostgreSQL database in RDS. Use AWS Batch with Spot EC2 instances to cost-effectively migrate the data from the source database to the target database in a batch process
Use the AWS Schema Conversion Tool (SCT) to convert the source schema to match that of the target database. Migrate the data using the AWS Database Migration Service (DMS) from the source database to an Amazon RDS for PostgreSQL database
Migrate the database from your on-premises data center using the AWS Server Migration Service (SMS). Afterwards, use the AWS Database Migration Service to convert and migrate your data to Amazon RDS for PostgreSQL database
Use the AWS Serverless Application Model (SAM) service to transform your database to PostgreSQL using AWS Lambda functions. Migrate the database to RDS using the AWS Database Migration Service (DMS)
An electronics company has an on-premises network as well as a cloud infrastructure in AWS. The on-site data storage which is used by their enterprise document management system is heavily being used, and they are looking at utilizing the storage services in AWS for cost-effective backup and rapid disaster recovery. You are tasked to set up a storage solution that will provide a low-latency access to the enterprise document management system. Most of the documents uploaded in their system are printed circuit board (PCB) designs and schematic diagrams which are frequently used and accessed by their engineers, QA analysts, and their Research and Design department.
Hence, you also must ensure that these employees can access the entire dataset quickly, without sacrificing durability. How can you satisfy the requirement for this scenario?
Use a Cached volume gateway to retain low-latency access to your entire data set as well as your frequently accessed data
Create an S3 bucket and use the sync command to synchronize the data to and from your on-premises file server
In AWS Storage Gateway, create a File gateway that enables you to store and retrieve objects in Amazon S3 using industry-standard file protocols such as Network File System (NFS) and Server Message Block (SMB)
Use a Stored Volume Gateway to provide cloud-backed storage volumes that you can mount as Internet Small Computer System Interface (iSCSI) devices from your on-premises application servers
A media company has established a Direct Connect connection between their on-premises data center and their VPC in AWS. The web applications hosted on their data center are experiencing high latency when accessing data from S3 bucket.
As the Solutions Architect, what can you do to reduce the latency in this hybrid cloud architecture?
In your on-premises data center, add a Border Gateway Protocol (BGP) Route that connects to the public S3 endpoint of your VPC
Set up a VPN connection from the VPC to the public S3 endpoint
Set up a public virtual interface to connect to a public S3 endpoint resource via the Direct Connect connection
Set up a private virtual interface to connect to the public S3 endpoint via the Direct Connect connection
To ensure and strengthen data security, your company has launched a company-wide bug bounty program to find and patch up security vulnerabilities in your web applications as well as the underlying cloud resources. You are working as a Cloud Engineer and decided to focus on checking system vulnerabilities of your AWS resources.
Which of the following are the best techniques to avoid Distributed Denial of Service (DDoS) attacks for your cloud infrastructure hosted in AWS? (Choose 2)
Add multiple Elastic Network Interfaces to each EC2 instance and use Enhanced Networking to increase the network bandwidth
Use S3 instead of EBS Volumes for storing data. Install the SSM agent to all your instances and use AWS Systems Manager Patch Manager to automatically patch your instances
Use an Application Load Balancer (ALB) to reduce the risk of overloading your application by distributing traffic across many backend instances. Integrate AWS WAF and the ALB to protect your web applications from common web exploits that could affect application availability
Use an Amazon CloudFront distribution for both static and dynamic content of your web applications. Add CloudWatch alerts to automatically look and notify the Operations team for high CPUUtilization and Netw0orkIn metrics, as well as to trigger Auto Scaling of your EC2 instances
Use Reserved EC2 instances to ensure that each instance has the maximum performance possible. Use AWS WAF to protect your web applications from common web exploits that could affect application availability
