Font size
WorksheetsAWS CERTIFIED SOLUTIONS ARCHITECT RANDOM
Total questions: 65
Worksheet time: 2hrs 10mins
A company has a web application that uses Amazon CloudFront to distribute its images, videos, and other static content stored in its Amazon S3 bucket to users around the world. The company has recently introduced a new member-only access feature for some of its high-quality media files. There is a requirement to provide access to multiple private media files only to paying subscribers without having to change the current URLs.
Which of the following is the most suitable solution to implement to satisfy this requirement?
Configure your CloudFront distribution to use Match Viewer as its Origin Protocol Policy which will automatically match the user request. This will allow access to the private content if the request is a paying member and deny it if it is not a member.
Create a Signed URL with a custom policy which only allows the members to see the private files.
Use Signed Cookies to control who can access the private files in your CloudFront distribution by modifying your application to determine whether a user should have access to your content. For members, send the required Set-Cookie headers to the viewer which will unlock the content only to them.
Configure your CloudFront distribution to use Field-Level Encryption to protect your private data and only allow access to members.
A company has a serverless application made up of AWS Amplify, Amazon API Gateway and a Lambda function. The application is connected to an Amazon RDS MySQL database instance inside a private subnet. A Lambda Function URL is also implemented as the dedicated HTTPS endpoint for the function, which has the following value:
https://12june1898pil1pinas.lambda-url.us-west-2.on.aws/
There are times during peak loads when the database throws a “too many connections” error preventing the users from accessing the application.
Which solution could the company take to resolve the issue?
Provision an RDS Proxy between the Lambda function and RDS database instance
Increase the concurrency limit of the Lambda function
Increase the memory allocation of the Lambda function
Increase the rate limit of API Gateway
A company deployed a web application that stores static assets in an Amazon Simple Storage Service (S3) bucket. The Solutions Architect expects the S3 bucket to immediately receive over 2000 PUT requests and 3500 GET requests per second at peak hour.
What should the Solutions Architect do to ensure optimal performance?
Use a predictable naming scheme in the key names such as sequential numbers or date time sequences.
Use Byte-Range Fetches to retrieve multiple ranges of an object data per GET request.
Do nothing. Amazon S3 will automatically manage performance at this scale.
Add a random prefix to the key names.
An intelligence agency is currently hosting a learning and training portal in AWS. Your manager instructed you to launch a large EC2 instance with an attached EBS Volume and enable Enhanced Networking. What are the valid case scenarios in using Enhanced Networking? (Select TWO.)
When you need a consistently lower inter-instance latencies
When you need a low packet-per-second performance
When you need a higher packet per second (PPS) performance
When you need a dedicated connection to your on-premises data center
When you need high latency networking
A company is generating confidential data that is saved on its on-premises data center. As a backup solution, the company wants to upload its data to an Amazon S3 bucket. In compliance with its internal security mandate, the encryption of the data must be done before sending it to S3. The company must spend time managing and rotating the encryption keys as well as controlling who can access those keys.
Which of the following methods can achieve this requirement? (Select TWO.)
Set up Client-Side Encryption with S3 managed encryption keys.
Set up Client-Side Encryption with AWS KMS key.
Set up Server-Side Encryption (SSE) with Amazon EC2 key pair.
Set up Server-Side Encryption with keys stored in a separate S3 bucket.
Set up Client-Side Encryption using a client-side master key.
A company has launched multiple Amazon EC2 instances inside a private subnet of a VPC. The Solutions Architect is reviewing the Network ACL (NACL) rules associated with that subnet to ensure security. The current Inbound Rules for the NACL are configured as follows:
<Ver gráfico>
A computer with the IP address 110.238.109.37 attempts to send a request to one of the EC2 instances in this subnet.
What will happen to the incoming request based on the NACL rules?
Initially, it will be denied and then after a while, the connection will be allowed.
Initially, it will be allowed and then after a while, the connection will be denied.
It will be allowed.
It will be denied.
A company has a running m5ad.large EC2 instance with a default attached 75 GB SSD instance-store backed volume. You shut it down and then start the instance. You noticed that the data which you saved earlier on the attached volume is no longer available.
What might be the cause of this?
The EC2 instance was using instance store volumes, which are ephemeral and only live for the life of the instance.
The instance was hit by a virus that wipes out all data.
The volume of the instance was not big enough to handle all of the processing data.
The EC2 instance was using EBS backed root volumes, which are ephemeral and only live for the life of the instance.
A company has both on-premises data center as well as AWS cloud infrastructure. Multimedia assets, such as graphics, audio, and videos, are primarily stored in an on-premises storage server, with an Amazon S3 Standard storage class bucket used for backup. The data is heavily utilized for only one week (7 days), but after that period, it is infrequently accessed by customers. The Solutions Architect is tasked with saving storage costs in AWS while maintaining the ability to retrieve a subset of media assets within minutes for an annual data audit, which will be conducted on cloud storage.
Which of the following are valid options that the Solutions Architect can implement to meet the above requirement? (Select TWO.)
Set a lifecycle policy in the bucket to transition the data from Standard storage class to Glacier Flexible Retrieval after one week (7 days).
Set a lifecycle policy in the bucket to transition the data to S3 – Standard IA storage class after one week (7 days).
Set a lifecycle policy in the bucket to transition to S3 – Standard IA after 30 days
Set a lifecycle policy in the bucket to transition the data to S3 – One Zone-Infrequent Access storage class after one week (7 days).
Set a lifecycle policy in the bucket to transition the data to S3 Glacier Deep Archive storage class after one week (7 days).
A company is using an Amazon RDS for MySQL 5.6 with Multi-AZ deployment enabled and several web servers across two AWS Regions. The database is currently experiencing highly dynamic reads due to the growth of the company’s website. The Solutions Architect tried to test the read performance from the secondary AWS Region and noticed a notable slowdown on the SQL queries.
Which of the following options would provide a read replication latency of less than 1 second?
Migrate the existing database to Amazon Aurora and create a cross-region read replica.
Use Amazon ElastiCache to improve database performance.
Upgrade the MySQL database engine.
Create an Amazon RDS for MySQL read replica in the secondary AWS Region.
A company that is rapidly growing in recent months has been in the process of setting up IAM users on its single AWS Account. A solutions architect has been tasked to handle the user management, which includes granting read-only access to users and denying permissions whenever an IAM user has no MFA setup. New users will be added frequently based on their respective departments.
Which of the following action is the MOST secure way to grant permissions to the new users?
Launch an IAM Group for each department. Create an IAM Policy that enforces MFA authentication with the least privilege permission. Attach the IAM Policy to each IAM Group.
Create a Service Control Policy (SCP) that enforces MFA authentication for each department. Add a trust relationship to every SCP and attach it to each IAM User.
Set up IAM roles for each IAM user and associate a permissions boundary that defines the maximum permissions.
Create an IAM Role that enforces MFA authentication with the least privilege permission. Set up a corresponding IAM Group for each department. Attach the IAM Role to the IAM Groups.
A newly hired Solutions Architect is checking all of the security groups and network access control list rules of the company’s AWS resources. For security purposes, the MS SQL connection via port 1433 of the database tier should be secured. Below is the security group configuration of their Microsoft SQL Server database:
<ver gráfico>
The application tier hosted in an Auto Scaling group of EC2 instances is the only identified resource that needs to connect to the database. The Architect should ensure that the architecture complies with the best practice of granting least privilege.
Which of the following changes should be made to the security group configuration?
For the MS SQL rule, change the Source to the Network ACL ID attached to the application tier.
For the MS SQL rule, change the Source to the EC2 instance IDs of the underlying instances of the Auto Scaling group.
For the MS SQL rule, change the Source to the security group ID attached to the application tier.
For the MS SQL rule, change the Source to the static AnyCast IP address attached to the application tier.
A tech company currently has an on-premises infrastructure. They are currently running low on storage and want to have the ability to extend their storage using the AWS cloud.
Which AWS service can help them achieve this requirement?
Amazon SQS
AWS Storage Gateway
Amazon EC2
Amazon Elastic Block Storage
The start-up company that you are working for has a batch job application that is currently hosted on an EC2 instance. It is set to process messages from a queue created in SQS with default settings. You configured the application to process the messages once a week. After 2 weeks, you noticed that not all messages are being processed by the application.
What is the root cause of this issue?
The batch job application is configured to long polling.
Amazon SQS has automatically deleted the messages that have been in a queue for more than the maximum message retention period.
Missing permissions in SQS.
The SQS queue is set to short-polling.
A Solutions Architect for a global news company is configuring a fleet of EC2 instances in a subnet that currently is in a VPC with an Internet gateway attached. All of these EC2 instances can be accessed from the Internet. The architect launches another subnet and deploys an EC2 instance in it, however, the architect is not able to access the EC2 instance from the Internet.
What could be the possible reasons for this issue? (Select TWO.)
The Amazon EC2 instance is not a member of the same Auto Scaling group.
The Amazon EC2 instance does not have a public IP address associated with it.
The route table is not configured properly to send traffic from the EC2 instance to the Internet through the Internet gateway.
The route table is not configured properly to send traffic from the EC2 instance to the Internet through the customer gateway (CGW).
The Amazon EC2 instance does not have an attached Elastic Fabric Adapter (EFA).
A Docker application, which is running on an Amazon ECS cluster behind a load balancer, is heavily using Amazon DynamoDB. The application requires improved database performance by distributing the workload evenly and utilizing the provisioned throughput efficiently.
Which of the following should be implemented for the DynamoDB table?
Avoid using a composite primary key, which is composed of a partition key and a sort key.
Use partition keys with high-cardinality attributes, which have a large number of distinct values for each item.
Reduce the number of partition keys in the DynamoDB table.
Use partition keys with low-cardinality attributes, which have a few number of distinct values for each item.
An e-commerce company runs a highly scalable web application that depends on an Amazon Aurora database. As the number of users increases, the read replica faces difficulties keeping up with the increasing read traffic, causing performance bottlenecks during peak periods.
Which of the following will resolve the issue with the most cost-effective solution?
Set up a read replica that can operate across different regions.
Implement read scaling with Aurora Global Database.
Use automatic scaling for the Aurora read replica using Aurora Auto Scaling.
Increase the size of the Aurora DB cluster.
A tech company has a CRM application hosted on an Auto Scaling group of On-Demand EC2 instances with different instance types and sizes. The application is extensively used during office hours from 9 in the morning to 5 in the afternoon. Their users are complaining that the performance of the application is slow during the start of the day but then works normally after a couple of hours.
Which of the following is the MOST operationally efficient solution to implement to ensure the application works properly at the beginning of the day?
Configure a Dynamic scaling policy for the Auto Scaling group to launch new instances based on the CPU utilization.
Configure a Dynamic scaling policy for the Auto Scaling group to launch new instances based on the Memory utilization.
Configure a Scheduled scaling policy for the Auto Scaling group to launch new instances before the start of the day.
Configure a Predictive scaling policy for the Auto Scaling group to automatically adjust the number of Amazon EC2 instances
A serverless application has been launched on the DevOps team’s AWS account. Users from the development team’s account must be granted permission to invoke the Lambda function that runs the application. The solution must use the principle of least privilege access.
Which solution will fulfill these criteria?
On the function’s resource-based policy, add a permission that includes the lambda:* as action and arn:aws:iam::[DevOps AWS Account Number]:root as principal.
On the function’s execution role, add a permission that includes the lambda:InvokeFunction as action and arn:aws:iam::[DEV AWS Account Number]:root as principal.
On the function’s execution role, add a permission that includes the lambda:* as action and arn:aws:iam::[DevOps AWS Account Number]:root as principal.
On the function’s resource-based policy, add a permission that includes the lambda:InvokeFunction as action and arn:aws:iam::[DEV AWSAccount Number]:root as principal.
A company has established a dedicated network connection from its on-premises data center to AWS Cloud using AWS Direct Connect (DX). The core network services, such as the Domain Name System (DNS) service and Active Directory services, are all hosted on-premises. The company has new AWS accounts that will also require consistent and dedicated access to these network services.
Which of the following can satisfy this requirement with the LEAST amount of operational overhead and in a cost-effective manner?
Create a new AWS VPN CloudHub. Set up a Virtual Private Network (VPN) connection for additional AWS accounts.
Create a new Direct Connect gateway and integrate it with the existing Direct Connect connection. Set up a Transit Gateway between AWS accounts and associate it with the Direct Connect gateway.
Set up a new Direct Connect gateway and integrate it with the existing Direct Connect connection. Configure a VPC peering connection between AWS accounts and associate it with Direct Connect gateway.
Set up another Direct Connect connection for each and every new AWS account that will be added.
A company is using a combination of API Gateway and AWS Lambda for the web services of an online web portal that is accessed by hundreds of thousands of clients each day. The company will be announcing a new revolutionary product, and it is expected that the web portal will receive a massive number of visitors from all around the globe.
How can the back-end systems and applications be protected from traffic spikes?
Use throttling limits in API Gateway
API Gateway will automatically scale and handle massive traffic spikes so you do not have to do anything.
Deploy Multi-AZ in API Gateway with Read Replica
Manually upgrade the Amazon EC2 instances being used by API Gateway
A company plans to launch an application that tracks the GPS coordinates of delivery trucks in the country. The coordinates are transmitted from each delivery truck every five seconds. The must be able to process coordinates from multiple consumers in real-time. The aggregated data will be analyzed in a separate reporting application.
Which AWS service should you use for this scenario?
Amazon AppStream
Amazon Elastic MapReduce (EMR)
Amazon Kinesis
Amazon Simple Queue Service
A web application is hosted in an Auto Scaling group of EC2 instances deployed across multiple Availability Zones behind an Application Load Balancer. You need to implement an SSL solution for your system to improve its security which is why you requested an SSL/TLS certificate from a third-party certificate authority (CA).
Where can you safely import the SSL/TLS certificate of your application? (Select TWO.)
AWS Certificate Manager
An S3 bucket configured with server-side encryption with customer-provided encryption keys (SSE-C)
IAM certificate store
A private S3 bucket with versioning enabled
CloudFront
A company has an enterprise web application hosted on Amazon ECS Docker containers that use an Amazon FSx for Lustre filesystem for its high-performance computing workloads. A warm standby environment is running in another AWS region for disaster recovery. A Solutions Architect was assigned to design a system that will automatically route the live traffic to the disaster recovery (DR) environment only in the event that the primary application stack experiences an outage.
What should the Architect do to satisfy this requirement?
SSet up an Amazon EventBridge rule to monitor the primary Route 53 DNS endpoint and create a custom AWS Lambda function. Execute the ChangeResourceRecordSets API call using the function to initiate the failover to the secondary DNS record.
Set up a failover routing policy configuration in Route 53 by adding a health check on the primary service endpoint. Configure Route 53 to direct the DNS queries to the secondary record when the primary resource is unhealthy. Configure the network access control list and the route table to allow Route 53 to send requests to the endpoints specified in the health checks. Enable the Evaluate Target Health option by setting it to Yes.
Set up an Amazon CloudWatch Alarm to monitor the primary Route 53 DNS endpoint and create a custom AWS Lambda function. Execute the ChangeResourceRecordSets API call using the function to initiate the failover to the secondary DNS record.
Set up a Weighted routing policy configuration in Route 53 by adding health checks on both the primary stack and the DR environment. Configure the network access control list and the route table to allow Route 53 to send requests to the endpoints specified in the health checks. Enable the Evaluate Target Health option by setting it to Yes.
A data analytics company, which uses machine learning to collect and analyze consumer data, is using Redshift cluster as their data warehouse. You are instructed to implement a disaster recovery plan for their systems to ensure business continuity even in the event of an AWS region outage.
Which of the following is the best approach to meet this requirement?
Enable Cross-Region Snapshots Copy in your Amazon Redshift Cluster.
Do nothing because Amazon Redshift is a highly available, fully-managed data warehouse which can withstand an outage of an entire AWS region.
Create a scheduled job that will automatically take the snapshot of your Redshift Cluster and store it to an S3 bucket. Restore the snapshot in case of an AWS region outage.
Use Automated snapshots of your Redshift Cluster.
A travel photo-sharing website is using Amazon S3 to serve high-quality photos to visitors. After a few days, it was discovered that other travel websites are linking to and using these photos. This has resulted in financial losses for the business.
What is the MOST effective method to mitigate this issue?
Use Amazon CloudFront distributions for your photos.
Store and privately serve the high-quality photos on Amazon WorkDocs instead.
Configure your S3 bucket to remove public read access and use pre-signed URLs with expiry dates.
Block the IP addresses of the offending websites using NACL.
A company is using AWS IAM to manage access to AWS services. The Solutions Architect of the company created the following IAM policy for AWS Lambda:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"lambda:CreateFunction",
"lambda:DeleteFunction"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": [
"lambda:CreateFunction",
"lambda:DeleteFunction",
"lambda:InvokeFunction",
"lambda:TagResource"
],
"Resource": "*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "187.5.104.11/32"
}
}
}
]
}
Which of the following options is allowed by this policy?
Delete an AWS Lambda function using the 187.5.104.11/32 address.
Create an AWS Lambda function using the 187.5.104.11/32 address.
Create an AWS Lambda function using the 100.220.0.11/32 address.
Delete an AWS Lambda function from any network address.
A company has a requirement to move an 80 TB data warehouse to the cloud. It would take 2 months to transfer the data based on the current bandwidth allocation.
Which option is the most cost-effective for quick data upload to AWS?
AWS Snowball Edge
AWS DataSync
AWS Direct Connect
Amazon S3 Multipart Upload
A company requires all the data stored in the cloud to be encrypted at rest. To easily integrate this with other AWS services, they must have full control over the encryption of the created keys and also the ability to immediately remove the key material from AWS KMS. The solution should also be able to audit the key usage independently of AWS CloudTrail.
Which of the following options will meet this requirement?
Use AWS Key Management Service to create AWS owned Keys and store the non-extractable key material in AWS CloudHSM.
Use AWS Key Management Service to create a KMS key in a custom key store and store the non-extractable key material in Amazon S3.
Use AWS Key Management Service to create a KMS key in a custom key store and store the non-extractable key material in AWS CloudHSM.
Use AWS Key Management Service to create AWS managed keys and store the non-extractable key material in AWS CloudHSM.
A large corporation has several Windows file servers in various departments within its on-premises data center. To improve its data management and scalability, the corporation has to migrate and integrate its files into an Amazon FSx for Windows File Server file system while keeping the current file permissions intact.
Which of the following solutions will fulfill the company’s requirements? (Select TWO.)
Use AWS Storage Gateway to create a file gateway, then mount the file gateway on the on-premises file servers. Migrate the data from the file servers to the file gateway, and then use AWS DataSync to move the data from the file gateway to the FSx for Windows File Server file system.
Set up AWS DataSync agents on the corporation's on-premises file servers and schedule DataSync tasks for transferring data to the FSx for Windows File Server file system.
Utilize the AWS CLI to copy the file shares from each on-premises file server to an Amazon S3 bucket. Then, schedule AWS DataSync tasks to move the data from S3 to the FSx for Windows File Server file system
Order an AWS Snowball Edge Storage Optimized device, link it to the on-premises network, and transfer data using the AWS CLI. Return the device to AWS for data import into Amazon S3. Configure AWS DataSync tasks to migrate the data from S3 to the FSx for Windows File Server file system
Acquire an AWS Snowcone device, then connect with the on-premises network. Use AWS OpsHub to launch the AWS DataSync agent AMI and activate the agent via the AWS Management Console. Schedule DataSync tasks to transfer the data to the FSx for Windows File Server file system.
A company has an infrastructure that allows EC2 instances from a private subnet to fetch objects from Amazon S3 via a NAT Instance. The company’s Solutions Architect was instructed to lower down the cost incurred by the current solution.
How should the Solutions Architect redesign the architecture in the most cost-efficient manner?
Replace the NAT instance with NAT Gateway to access S3 objects.
Remove the NAT instance and create an S3 gateway endpoint to access S3 objects.
Use a smaller instance type for the NAT instance.
Remove the NAT instance and create an S3 interface endpoint to access S3 objects.
A multinational company has been building its new data analytics platform with high-performance computing workloads (HPC) which requires a scalable, POSIX-compliant storage service. The data need to be stored redundantly across multiple AZs and allows concurrent connections from thousands of EC2 instances hosted on multiple Availability Zones.
Which of the following AWS storage service is the most suitable one to use in this scenario?
Amazon EBS Volumes
Amazon Elastic File System
Amazon S3
Amazon ElastiCache
A manufacturing company launched a new type of IoT sensor. The sensor will be used to collect large streams of data records. You need to create a solution that can ingest and analyze the data in real-time with millisecond response times.
Which of the following is the best option that you should implement in this scenario?
Ingest the data using Amazon Data Firehose and create an AWS Lambda function to store the data in Amazon DynamoDB.
Ingest the data using Amazon Kinesis Data Streams and create an AWS Lambda function to store the data in Amazon Redshift.
Ingest the data using Amazon Kinesis Data Streams and create an AWS Lambda function to store the data in Amazon DynamoDB.
Ingest the data using Amazon Simple Queue Service and create an AWS Lambda function to store the data in Amazon Redshift.
A disaster recovery team is planning to back up on-premises records to a local file server share through SMB protocol. To meet the company’s business continuity plan, the team must ensure that a copy of data from 48 hours ago is available for immediate access. Accessing older records with delay is tolerable.
Which should the DR team implement to meet the objective with the LEAST amount of configuration effort?
Create an SMB file share in Amazon FSx for Windows File Server that has enough storage to store all backups. Access the file share from on-premises.
Use an AWS Storage File gateway with enough storage to keep data from the last 48 hours. Send the backups to an SMB share mounted as a local disk.
Mount an Amazon EFS file system on the on-premises client and copy all backups to an NFS share.
Create an AWS Backup plan to copy data backups to a local SMB share every 48 hours.
A company is developing a scheduled job that copies a backup of its virtual machines (VMs) to an Amazon S3 bucket. To avoid tampering, these backups must be protected against overwrites. They should also be retained for 20 days before being automatically deleted.
Which combination of actions will meet these requirements? (Select TWO.)
Create an automated solution that tags objects to be covered by a 20-day retention policy.
Make a new S3 bucket and enable Versioning.
Set the objects to expire after 20 days using an S3 Lifecycle policy.
Make a new S3 bucket and enable S3 Object Lock. Set a 20-day retention period.
Make a new S3 bucket and enable S3 Object Lock. Set a 20-day legal hold.
A company has an application architecture that stores both the access key ID and the secret access key in a plain text file on a custom Amazon Machine Image (AMI). The EC2 instances, which are created by using this AMI, are using the stored access keys to connect to a DynamoDB table.
What should the Solutions Architect do to make the current architecture more secure?
Put the access keys in an Amazon S3 bucket instead.
Put the access keys in Amazon Glacier instead.
Remove the stored access keys in the AMI. Create a new IAM role with permissions to access the DynamoDB table and assign it to the EC2 instances.
Do nothing. The architecture is already secure because the access keys are already in the Amazon Machine Image.
A company has stored 200 TB of backup files in Amazon S3. The files are in a vendor-proprietary format. The Solutions Architect needs to use the vendor’s proprietary file conversion software to retrieve the files from their Amazon S3 bucket, transform the files to an industry-standard format, and re-upload the files back to Amazon S3. The solution must minimize the data transfer costs.
Which of the following options can satisfy the given requirement?
Export the data using AWS Snowball Edge device. Install the file conversion software on the device. Transform the data and re-upload it to Amazon S3.
Install the file conversion software in Amazon S3. Use S3 Batch Operations to perform data transformation.
Deploy the EC2 instance in a different Region. Install the conversion software on the instance. Perform data transformation and re-upload it to Amazon S3.
Deploy the EC2 instance in the same Region as Amazon S3. Install the file conversion software on the instance. Perform data transformation and re-upload it to Amazon S3.
A Solutions Architect designed a real-time data analytics system based on Kinesis Data Stream and Lambda. A week after the system has been deployed, the users noticed that it performed slowly as the data rate increases. The Architect identified that the performance of the Kinesis Data Streams is causing this problem.
Which of the following should the Architect do to improve performance?
Implement Step Scaling to the Kinesis Data Stream.
Improve the performance of the stream by decreasing the number of its shards using the MergeShard command.
Increase the number of shards of the Kinesis stream by using the UpdateShardCount command.
Replace the data stream with Amazon Data Firehose instead.
A tech company is currently using Auto Scaling for their web application. A new AMI now needs to be used for launching a fleet of EC2 instances. Which of the following changes needs to be done?
Create a new target group and launch template.
Create a new target group.
Do nothing. You can start directly launching EC2 instances in the Auto Scaling group with the same launch template.
Create a new launch template.
A company has several microservices that send messages to an Amazon SQS queue and a backend application that poll the queue to process the messages. The company also has a Service Level Agreement (SLA) which defines the acceptable amount of time that can elapse from the point when the messages are received until a response is sent. The backend operations are I/O-intensive as the number of messages is constantly growing, causing the company to miss its SLA. The Solutions Architect must implement a new architecture that improves the application’s processing time and load management.
Which of the following is the MOST effective solution that can satisfy the given requirement?
Create an AMI of the backend application’s EC2 instance. Use the image to set up an Auto Scaling group and configure a target tracking scaling policy based on the CPUUtilization metric with a target value of 80%.
Create an AMI of the backend application's EC2 instance and replace it with a larger instance size.
Create an AMI of the backend application’s EC2 instance. Use the image to set up an Auto Scaling group and configure a target tracking scaling policy based on the ApproximateAgeOfOldestMessage metric.
Create an AMI of the backend application's EC2 instance and launch it to a cluster placement group.
A newly hired Solutions Architect is assigned to manage a set of CloudFormation templates that are used in the company’s cloud architecture in AWS. The Architect accessed the templates and tried to analyze the configured IAM policy for an S3 bucket.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::boracay/*" } ] }
What does the above IAM policy allow? (Select THREE.)
An IAM user with this IAM policy is allowed to read objects in the boracay S3 bucket but not allowed to list the objects in the bucket.
An IAM user with this IAM policy is allowed to read objects from the boracay S3 bucket.
An IAM user with this IAM policy is allowed to read objects from all S3 buckets owned by the account.
An IAM user with this IAM policy is allowed to write objects into the boracay S3 bucket.
An IAM user with this IAM policy is allowed to change access rights for the boracay S3 bucket.
A company is looking to store its confidential financial files in AWS, which are accessed every week. The Architect was instructed to set up the storage system, which uses envelope encryption and automates key rotation. It should also provide an audit trail that shows who used the encryption key and by whom for security purposes.
Which combination of actions should the Architect implement to satisfy the requirement in the most cost-effective way? (Select TWO.)
Use Amazon S3 to store the data.
Configure Server-Side Encryption with AWS KMS Keys (SSE-KMS).
Configure Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
Use Amazon S3 Glacier Deep Archive to store the data.
Configure Server-Side Encryption with Customer-Provided Keys (SSE-C).
A large consulting firm is in the process of conducting an internal security audit of its cloud infrastructure. The goal is to ensure that the information in its Amazon S3 bucket, which is associated with the firm’s AWS Lake Formation data lake, doesn’t include confidential data related to its customers or staff.
The firm aims to uncover financial or personally identifiable information (PII), such as passport, credit card numbers, and taxpayer identification numbers, in its S3 bucket. This will prevent any sensitive data from being ingested into a data lake.
What solution would be the most operationally effective solution in meeting these particular requirements?
Set up Amazon S3 Inventory for the S3 bucket and then configure Amazon Athena to conduct queries on the generated inventory.
Set up AWS Glue DataBrew to identify and cleanse sensitive data in the S3 bucket.
Implement AWS Audit Manager within the AWS account and opt for auditing based on the Payment Card Industry Data Security Standards (PCI DSS).
Utilize Amazon Macie to perform a comprehensive data discovery operation using managed identifiers to detect various data types.
An organization stores and manages financial records of various companies in its on-premises data center, which is almost out of space. The management decided to move all of their existing records to a cloud storage service. All future financial records will also be stored in the cloud. For additional security, all records must be prevented from being deleted or overwritten.
Which of the following should you do to meet the above requirement?
Use AWS Storage Gateway to establish hybrid cloud storage. Store all of your data in Amazon S3 and enable object lock.
Use AWS Storage Gateway to establish hybrid cloud storage. Store all of your data in Amazon EBS and enable object lock.
Use AWS DataSync to move the data. Store all of your data in Amazon EFS and enable object lock.
Use AWS DataSync to move the data. Store all of your data in Amazon S3 and enable object lock.
A company launched a website that accepts high-quality photos and turns the photos into a downloadable video montage. The website offers both a free and a premium account, with the premium account guaranteeing faster processing. All requests by both free and premium members go through a single Amazon SQS queue and are then processed by a group of Amazon EC2 instances that generate the videos. The company needs to ensure that premium users, who paid for the service, have higher priority than free members.
How should the company re-design its architecture to address this requirement?
Use Amazon Kinesis to process the photos and generate the video montage in real-time.
Use Amazon S3 to store and process the photos and then generate the video montage afterward.
For the requests made by premium members, set a higher priority in the SQS queue so it will be processed first compared to the requests made by free members.
Create an SQS queue for free members and another one for premium members. Configure your EC2 instances to consume messages from the premium queue first and if it is empty, poll from the free members' SQS queue.
A music publishing company is building a multitier web application that requires a key-value store which will save the document models. Each model is composed of band ID, album ID, song ID, composer ID, lyrics, and other data. The web tier will be hosted in an Amazon ECS cluster with AWS Fargate launch type.
Which of the following is the MOST suitable setup for the database-tier?
Launch an Amazon Aurora Serverless database.
Launch an Amazon RDS database with Read Replicas.
Launch a DynamoDB table.
Use Amazon WorkDocs to store the document models.
A company has a regional API Gateway in the us-east-2 region that serves as a proxy to a backend service. Clients connect to the service using the invoke URL of the API stage. To improve usability, the company wants to associate a custom domain name (api.joedayz.com) with the API. Moreover, the domain name must support HTTPS to ensure secure connections. The company has an existing hosted zone for its domain on Amazon Route 53.
Which of the following would be the next step to achieve the company’s objective?
Import an existing public certificate for api.joedayz.com into AWS Certificate Manager (ACM) in the us-east-2. In Route 53, create a CNAME record for api.joedayz.com that points to the invoke URL of the API Gateway stage.
Use the AWS Certificate Manager Private Certificate Authority (ACM PCA) to generate a private certificate for api.joedayz.com. Override the invoke URL using stage variables.
Request a public certificate in the us-east-1 region for api.tutorialsdojo.com using AWS Certificate Manager (ACM). Create a regional API Gateway domain name and associate it with api.joedayz.com and the ACM certificate. In Route 53, create an alias record for api.joedayz.com that points to the API Gateway domain name.
Request a public certificate in the us-east-2 region for api.tutorialsdojo.com using AWS Certificate Manager (ACM). Create a regional API Gateway domain name and associate it with api.joedayz.com and the ACM certificate. In Route 53, create an alias record for api.joedayz.com that points to the API Gateway domain name.
A company has two On-Demand EC2 instances inside the Virtual Private Cloud in the same Availability Zone but are deployed to different subnets. One EC2 instance is running a database and the other EC2 instance a web application that connects with the database. You need to ensure that these two instances can communicate with each other for the system to work properly.
What are the things you have to check so that these EC2 instances can communicate inside the VPC? (Select TWO.)
Check if both instances are the same instance class.
Check the Network ACL if it allows communication between the two subnets.
Check if the default route is set to a NAT instance or Internet Gateway (IGW) for them to communicate.
Ensure that the EC2 instances are in the same Placement Group.
Check if all security groups are set to allow the application host to communicate to the database on the right port and protocol.
A Solutions Architect is designing a setup for a database that will run on Amazon RDS for MySQL. He needs to ensure that the database can automatically failover to an RDS instance to continue operating in the event of failure. The architecture should also be as highly available as possible.
Which among the following actions should the Solutions Architect do?
Create a read replica in the same region where the DB instance resides. In addition, create a read replica in a different region to survive a region’s failure. In the event of an Availability Zone outage, promote any replica to become the primary instance.
Create a standby replica in another availability zone by enabling Multi-AZ deployment.
Create five cross-region read replicas in each region. In the event of an Availability Zone outage, promote any replica to become the primary instance.
Create five read replicas across different availability zones. In the event of an Availability Zone outage, promote any replica to become the primary instance.
A technology company has a suite of container-based web applications and serverless solutions that are hosted in AWS. The Solutions Architect must define a standard infrastructure that will be used across development teams and applications. There are application-specific resources too that change frequently, especially during the early stages of application development. Developers must be able to add supplemental resources to their applications, which are beyond what the architects predefined in the system environments and service templates.
Which of the following should be implemented to satisfy this requirement?
Set up AWS Proton for deploying container applications and serverless solutions. Create components from the AWS Proton console and attach them to their respective service instance.
Set up AWS Control Tower to automate container-based application deployments. Use AWS Config for application-specific resources that change frequently.
Use the Amazon EKS Anywhere service for deploying container applications and serverless solutions. Create a service instance for each application-specific resource.
Use the Amazon Elastic Container Service (ECS) Anywhere service for deploying container applications and serverless solutions. Configure Prometheus metrics collection on the ECS cluster and use Amazon Managed Service for Prometheus for monitoring frequently-changing resources
A digital bank has recently deployed a fraud detection model in AWS Lambda. The company intends to put the model to test by processing transactions that are recorded in the production DynamoDB table. The security team must be immediately notified when a transaction is flagged as fraudulent.
How can the solutions architect satisfy the requirements while minimizing the impact on database operations and performance?
Create a DynamoDB global table for the Lambda function to work on. Send notifications to the team members using Amazon SQS.
Enable DynamoDB Streams and set the Lambda function as the trigger. Alert each member by having them subscribed to an SNS topic.
Insert data into the table using DynamoDB transactions and set the Lambda function as target. Send alerts to the team by having each member subscribed to an SNS topic.
Create a local secondary index and project the attributes required by the model into it. Run the Lambda function on schedule and let the team subscribe to an SNS topic for notification.
A computer animation film studio runs a web application on an Amazon EC2 instance. It uploads 5 GB video objects to an Amazon S3 bucket. Video uploads take longer than expected, impacting the application’s performance.
Which method will help improve the performance of the application?
Leverage on Amazon CloudFront and use HTTP POST method to reduce latency.
Use Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS volumes in a Logical Volume Management (LVM) stripe configuration on an EBS-optimized instance to maximize throughput.
Enable Enhanced Networking with the Elastic Network Adapter (ENA) on your EC2 Instances.
Use S3 Multipart Upload API.
A company has an on-premises MySQL database that needs to be replicated in Amazon S3 as CSV files. The database will eventually be launched to an Amazon Aurora Serverless cluster and be integrated with an RDS Proxy to allow the web applications to pool and share database connections. Once data has been fully copied, the ongoing changes to the on-premises database should be continually streamed into the S3 bucket. The company wants a solution that can be implemented with little management overhead yet still highly secure.
Which ingestion pattern should a solutions architect take?
Create a full load and change data capture (CDC) replication task using AWS Database Migration Service (AWS DMS). Add a new Certificate Authority (CA) certificate and create an AWS DMS endpoint with SSL.
Set up a full load replication task using AWS Database Migration Service (AWS DMS). Launch an AWS DMS endpoint with SSL using the AWS Network Firewall service.
Use an AWS Snowball Edge cluster to migrate data to Amazon S3 and AWS DataSync to capture ongoing changes. Create your own custom AWS KMS envelope encryption key for the associated AWS Snowball Edge job.
Use AWS Schema Conversion Tool (AWS SCT) to convert MySQL data to CSV files. Set up the AWS Application Migration Service (AWS MGN) to capture ongoing changes from the on-premises MySQL database and send them to Amazon S3.
A company is using an On-Demand EC2 instance to host a legacy web application that uses an Amazon Instance Store-Backed AMI. The web application should be decommissioned as soon as possible and hence, you need to terminate the EC2 instance.
When the instance is terminated, what happens to the data on the root volume?
Data is unavailable until the instance is restarted.
Data is automatically deleted.
Data is automatically saved as an EBS snapshot.
Data is automatically saved as an EBS volume.
There is a technical requirement by a financial firm that does online credit card processing to have a secure application environment on AWS. They are trying to decide on whether to use KMS or CloudHSM.
Which of the following statements is right when it comes to CloudHSM and KMS?
AWS CloudHSM should always be used for any payment transactions.
No major difference. They both do the same thing.
If you want a managed service for creating and controlling your encryption keys but don't want or need to operate your own HSM, consider using AWS CloudHSM.
You should consider using AWS CloudHSM over AWS KMS if you require your keys stored in dedicated, third-party validated hardware security modules under your exclusive control.
A company plans to migrate its suite of containerized applications running on-premises to a container service in AWS. The solution must be cloud-agnostic and use an open-source platform that can automatically manage containerized workloads and services. It should also use the same configuration and tools across various production environments.
What should the Solution Architect do to properly migrate and satisfy the given requirement?
Migrate the application to Amazon Elastic Container Service with ECS tasks that use the Amazon EC2 launch type.
Migrate the application to Amazon Container Registry (ECR) with Amazon EC2 instance worker nodes.
Migrate the application to Amazon Elastic Kubernetes Service with EKS worker nodes.
Migrate the application to Amazon Elastic Container Service with ECS tasks that use the AWS Fargate launch type.
A solutions architect is managing an application that runs on a Windows EC2 instance with an attached Amazon FSx for Windows File Server. To save cost, management has decided to stop the instance during off-hours and restart it only when needed. It has been observed that the application takes several minutes to become fully operational which impacts productivity.
How can the solutions architect speed up the instance’s loading time without driving the cost up?
Migrate the application to an EC2 instance with hibernation enabled.
Disable the Instance Metadata Service to reduce the things that need to be loaded at startup.
Migrate the application to a Linux-based EC2 instance.
Enable the hibernation mode on the EC2 instance.
A healthcare organization wants to build a system that can predict drug prescription abuse. The organization will gather real-time data from multiple sources, which include Personally Identifiable Information (PII). It’s crucial that this sensitive information is anonymized prior to landing in a NoSQL database for further processing.
Which solution would meet the requirements?
Deploy an Amazon Data Firehose stream to capture and transform the streaming data. Deliver the anonymized data to Amazon Redshift for analysis.
Ingest real-time data using Amazon Kinesis Data Stream. Use an AWS Lambda function to anonymize the PII, then store it in Amazon DynamoDB.
Stream the data in an Amazon DynamoDB table. Enable DynamoDB Streams, and configure an AWS Lambda function with AmazonDynamoDBFullAccess permissions to perform anonymization on newly written items.
Create a data lake in Amazon S3 and use it as the primary storage for patient health data. Use an S3 trigger to run an AWS Lambda function that performs anonymization. Send the anonymized data to Amazon DynamoDB.
A company has a web crawler that regularly stores artifacts in an Amazon S3 bucket. An initial copy of the artifacts has been uploaded to another S3 bucket and an EFS volume. The company needs to ensure that any changes in the source bucket are replicated in the target resources.
Which solution will meet these requirements with the LEAST operational overhead?
Create an AWS DataSync location and task for both the destination S3 bucket and the EFS file system. Configure transfer mode to transfer all data.
Create an AWS Privatelink endpoint for Amazon S3. Configure an AWS Lambda function to copy files to the EFS file system and the destination S3 bucket. Set up an EventBridge rule that invokes the function when the PutObject action occurs in the source bucket.
In the same VPC, launch an Amazon EC2 instance and mount the EFS file system. Write a cron job that synchronizes changes between the source and destination S3 buckets and file systems.
Create an AWS DataSync location and task for both the destination S3 bucket and the EFS file system. Configure transfer mode to transfer only data that has changed.
An on-premises server uses an SMB network file share to store application data. The application produces around 50 MB of data per day, but it only needs to access some of it for daily processes. To save on storage costs, the company plans to copy all the application data to AWS. However, the goal is to retain the ability to retrieve data with the same low-latency access as the local file share. The company does not have the capacity to develop the needed tools for this operation.
Which of the following should the company use?
AWS Storage Gateway
Amazon FSx for Windows File Server
AWS Virtual Private Network (VPN)
AWS Snowball Edge
A web application is hosted on an EC2 instance that processes sensitive financial information. The EC2 instance is launched in a private subnet, and all data is stored in an Amazon S3 bucket. Users access financial information over the Internet through pre-signed URLs generated by the web application. The company’s security team is concerned that internet connectivity to Amazon S3 poses a security risk.
In this scenario, what will you do to resolve this security vulnerability in the most cost-effective manner?
Change the web architecture to access the financial data in S3 through an interface VPC endpoint, which is powered by AWS PrivateLink.
Change the web architecture to access the financial data in your S3 bucket through a VPN connection.
Change the web architecture to access the financial data hosted in your S3 bucket by creating a custom VPC endpoint service.
Change the web architecture to access the financial data through a Gateway VPC Endpoint.
The media company that you are working for has a video transcoding application running on Amazon EC2. Each EC2 instance polls a queue to find out which video should be transcoded, and then runs a transcoding process. If this process is interrupted, the video will be transcoded by another instance based on the queuing system. This application has a large backlog of videos which need to be transcoded. Your manager would like to reduce this backlog by adding more EC2 instances, however, these instances are only needed until the backlog is reduced.
In this scenario, which type of Amazon EC2 instance is the most cost-effective type to use?
Spot instances
On-demand instances
Reserved instances
Dedicated instances
A company has a top priority requirement to monitor certain database metrics and send email notifications to the Operations team if any issues occur.
Which combination of AWS services can accomplish this requirement? (Select TWO.)
Amazon Simple Queue Service (SQS)
Amazon CloudWatch
Amazon EC2 Instance with a running Berkeley Internet Name Domain (BIND) Server.
Amazon Simple Email Service
Amazon Simple Notification Service (SNS)
A financial application consists of an Auto Scaling group of Amazon EC2 instances, an Application Load Balancer, and a MySQL RDS instance set up in a Multi-AZ Deployment configuration. To protect customers’ confidential data, it must be ensured that the Amazon RDS database is only accessible using an authentication token specific to the profile credentials of EC2 instances.
Which of the following actions should be taken to meet this requirement?
Create an IAM Role and assign it to your EC2 instances which will grant exclusive access to your RDS instance.
Use a combination of IAM and STS to enforce restricted access to your RDS instance using a temporary authentication token.
Configure SSL in your application to encrypt the database connection to RDS.
Enable the IAM DB Authentication.
A company has a web application hosted on a fleet of EC2 instances located in two Availability Zones that are all placed behind an Application Load Balancer. As a Solutions Architect, you have to add a health check configuration to ensure your application is highly-available.
Which health checks will you implement?
FTP health check
ICMP health check
HTTP or HTTPS health check
TCP health check
A Solutions Architect is working for a multinational telecommunications company. The IT Manager wants to consolidate their log streams including the access, application, and security logs in one single system. Once consolidated, the company will analyze these logs in real-time based on heuristics. There will be some time in the future where the company will need to validate heuristics, which requires going back to data samples extracted from the last 12 hours.
What is the best approach to meet this requirement?
First, set up an Auto Scaling group of EC2 servers then store the logs on Amazon S3 then finally, use EMR to apply heuristics on the logs.
First, configure Amazon Cloud Trail to receive custom logs and then use EMR to apply heuristics on the logs.
First, send all the log events to Amazon SQS then set up an Auto Scaling group of EC2 servers to consume the logs and finally, apply the heuristics.
First, send all of the log events to Amazon Kinesis then afterwards, develop a client process to apply heuristics on the logs.
