AWS Certified Solutions Architect Professional Practice Exam

Practice Test 2: AWS Certified Solutions Architect Professional
Open

Practice Test 1: AWS Certified Solutions Architect…

Practice Test 3: AWS Certified Solutions Architect…

Set a certification due date

AWS Certified Solutions Architect – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: AWS Certified Solutions Architect Professional

Start

Start

Practice Test 3: AWS Certified Solutions Architect Professional

Start

Practice Test 4: AWS Certified Solutions Architect Professional

Start

Practice Test 5: AWS Certified Solutions Architect Professional

Start

Practice Test 6: AWS Certified Solutions Architect Professional

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] AWS Certified Solutions Architect Professional Practice Test Questions [SAP-C02] Exam Simulator + Explanations

Rating: 4.2 out of 54.2
1,847 ratings

35,250

Students

210 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified Solutions Architect Professional exam the first time with a great score

EXAM SIMULATION: All Practice Tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

REFERENCE LINKS: To help you understand the AWS concepts, all answers link to our online Training Notes (Cheat Sheets) with exam-specific information

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

MASTER THE CLOUD: Learn how to answer challenging scenario-based questions

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ALWAYS UP TO DATE: Our question bank is constantly updated based on student feedback from the latest SAP-C02 exam. New questions are added on a regular basis

ACTIVE Q&A FORUM: Our discussion board provides a platform for students to ask questions, share their recent exam experiences, and offer feedback on exam topics

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Show moreShow less

Description

Are you preparing for the AWS Certified Solutions Architect Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS Solutions Architect Professional practice exams to assess your exam-readiness!

These Practice Exams are the best way to prepare for your AWS Certified Solutions Architect Professional exam as they accurately reflect the style and level of difficulty of the real Amazon Web Services exam questions.

This course includes 6 sets of AWS practice tests and each practice test has 30 unique practice questions to optimize your study time. All questions are unique and 100% aligned with the latest AWS SAP-C02 exam blueprint.

SAP-C02 is a challenging exam that includes many long and complex questions that test deep knowledge of many AWS services. We've extracted the core topics from the latest exam blueprint and created this practice exam course that prepares you like no other. This training is your secret weapon to achieving this highly regarded AWS certification.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Don't just take our word for it – check out our reviews which confirm that our AWS practice questions closely match the exam pattern and difficulty. These practice tests will prepare you thoroughly for the real exam giving you the confidence you need to take and pass the AWS Certified Solutions Architect Pro exam.

This SAP-C02 practice test course includes:

180 exam-style questions with detailed answers and explanations to reinforce your understanding of the core concepts

Test report that highlights the areas you need to focus on

Regular updates to reflect the latest exam content

Realistic exam simulation to help you build confidence in your ability to pass your exam

Free bonus material to help you succeed in your exam

THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST SAP-C02 EXAM: Practice Tests are 100% scenario-based reflecting the current AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

DEEP DIVE REFERENCE LINKS: Our practice tests offer more than just answers – they link to relevant sections of our online "Training Notes," providing you with a comprehensive collection of exam-specific information for the AWS Solutions Architect Professional exam

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

LIFETIME ACCESS TO ALL FUTURE UPDATES: We're constantly improving and updating the questions based on exam feedback from thousands of our students.

REGULAR UPDATES: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

ADDITIONAL LEARNING RESOURCES: To help you succeed in your exam, we've included free learning material (optional, requires name/email) that complements the course content

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the actual AWS exam has a passing score of 75%, we recommend that you retake our AWS practice exams until you consistently score 80% or higher. It's important to put in the effort and study the online training notes in detail. Once you achieve the recommended score in our practice tests, you'll be well-prepared to sit the AWS exam and achieve a remarkable score.

GET FAMILIAR WITH EXAM FORMAT: Our AWS Solutions Architect Professional practice exams help you get familiar with the test question format and structure, giving you an edge in the actual AWS exam. While many practice tests in the market do not match the exam pattern format, you can trust that our practice tests will thoroughly prepare you for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS Solutions Architect Pro practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Solutions Architect Pro certification exam with confidence.

WHAT DO OTHER STUDENTS SAY?

Our practice tests are widely regarded as the best, providing you with the preparation you need to confidently pass your AWS Certified Solutions Architect Professional exam with a great score. But don't just take our word for it – check out the excellent course reviews from our happy students, who achieved an average passing score of over 850!

"I’ve literally just taken the AWS Solutions Architect Professional examination and I’d just like to say that the questions in this course are the most accurate I’ve ever come across"

"I am elated to share that I have passed my Solution Architect Professional! Thank you for these practice exams!"

"Neal has the BEST practice exams in the industry hands down!"

"Neal's practice tests were extremely useful for me as they were the closest to the real exam."

"Just passed my SA Pro exam. Have to admit that Neal’s Practice Tests are the most relevant to the real exam compared to others practice tests."

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy .

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to prepare for their AWS exams.

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED SOLUTIONS ARCHITECT PROFESSIONAL CERTIFICATION

The AWS Certified Solutions Architect Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS Solutions Architects are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified Solutions Architect Professional exam aims to test knowledge of the key services and tools used by Solutions Architects creating applications on AWS.

When you're ready to book your exam, you can do so on the AWS Training portal. Curious about the AWS Solutions Architect Professional certification cost? The SAP-C02 certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. It is our mission to ensure you pass your exam the first time and don't waste time or money. After going through the entire course and testing your knowledge with the AWS Solutions Architect Professional practice exams, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified Solutions Architect Professional exam who want to pass with confidence

Candidates preparing for the AWS Certified Solutions Architect Professional exam who want to pass their exam with confidence

Students who want to test their Cloud skills and assess their AWS exam readiness

Students who have completed the AWS Certified Solutions Architect Professional video course from Neal Davis and are looking for some final test prep

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

IT Professionals who want to enter any AWS technical Job interview with confidence

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

It is recommended that students have successfully passed the AWS Certified Solutions Architect Associate or have equivalent experience

Before assessing your exam readiness, we highly recommend our students to complete the AWS Certified Solutions Architect Professional Video Course by Neal Davis. These instructor-led video lectures from Digital Cloud Training build the solid knowledge foundation preparing students for the final step of their AWS certification journey

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 2: AWS Certified Solutions Architect Professional

AWS Certified Solutions Architect Professional - Results

Back to result overview
Attempt 3

All domains

All domains

AWS Storage

AWS Networking & Content Delivery

AWS Security, Identity, & Compliance

AWS Management & Governance

AWS Database

AWS Application Integration

AWS Compute

AWS Cost Management

AWS Migration & Transfer

35 all

0 correct

0 incorrect

35 skipped

0 marked

Collapse all questions

Question 1Skipped

A company runs applications on Microsoft Windows servers in an on-premises data center. The servers access a file system shared from one of the Windows servers. Several gigabytes of new data are produced daily. The company is migrating to the cloud and requires the data to be accessible on a file system in the AWS cloud.

Which data migration strategy should the company use?

Correct answer

Use AWS DataSync to schedule a daily task that replicates data between the on-premises file share and Amazon FSX.

Use an AWS Storage Gateway file gateway and point the existing on-premises application servers to the new file gateway.

Use AWS DataPipeline to schedule a daily task to replicate data between the on-premises file share and Amazon EFS.

Use an AWS Storage Gateway volume gateway and point the existing on-premises application servers to the new volume gateway.

Overall explanation

AWS recommends using AWS DataSync to transfer data between FSx for Windows File Server file systems. DataSync is a data transfer service that simplifies, automates, and accelerates moving and replicating data between on-premises storage systems and other AWS storage services over the internet or AWS Direct Connect. DataSync can transfer your file system data and metadata, such as ownership, timestamps, and access permissions.

DataSync supports copying NTFS access control lists (ACLs), and also supports copying file audit control information, also known as NTFS system access control lists (SACLs), which are used by administrators to control audit logging of user attempts to access files.

CORRECT: "Use AWS DataSync to schedule a daily task that replicates data between the on-premises file share and Amazon FSX" is the correct answer (as explained above.)

INCORRECT: "Use an AWS Storage Gateway file gateway and point the existing on-premises application servers to the new file gateway" is incorrect. When using a file gateway the data is accessible via SMB locally in the on-premises data and is synchronized to Amazon S3. Therefore, there the data is not accessible in the AWS cloud on a file system.

INCORRECT: "Use AWS DataPipeline to schedule a daily task to replicate data between the on-premises file share and Amazon EFS" is incorrect. AWS DataSync is designed for this use case whereas DataPipeline is more suitable to ETL use cases.

INCORRECT: "Use an AWS Storage Gateway volume gateway and point the existing on-premises application servers to the new volume gateway" is incorrect. A volume gateway is used for block-based storage not file-based storage. You access a volume gateway over iSCSI rather than SMB.

References:

https://docs.aws.amazon.com/fsx/latest/WindowsGuide/migrate-files-to-fsx-datasync.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Storage

Question 2Skipped

A solutions architect developed a web application that includes an AWS Lambda function that queries an Amazon Aurora MySQL database. The database is configured with three read replicas. During periods of high demand, the application does not meet performance requirements. A solutions architect noticed that the application opens many database connections, and this causes latency in the application

Which actions should the solutions architect take to improve the performance? (Select TWO.)

Configure the application to use the cluster endpoint of the Aurora database.

Create a Gateway Load Balancer to distribute connections across the three Aurora Read Replicas.

Correct selection

Move Lambda function code for opening the database connection outside of the event handler.

Correct selection

Connect an RDS Proxy connection pool to the reader endpoint of the Aurora database.

Configure an Amazon Aurora serverless database cluster and use automatic scaling.

Overall explanation

You can create and connect to read-only endpoints called reader endpoints when you use RDS Proxy with Aurora clusters. These reader endpoints help to improve the read scalability of your query-intensive applications. Reader endpoints also help to improve the availability of your connections if a reader DB instance in your cluster becomes unavailable.

It is a best practice to move the database connection outside the event handler so subsequent invocations of the Lambda function can reuse it.

CORRECT: "Connect an RDS Proxy connection pool to the reader endpoint of the Aurora database" is a correct answer (as explained above.)

CORRECT: "Move Lambda function code for opening the database connection outside of the event handler" is also a correct answer (as explained above.)

INCORRECT: "Configure the application to use the cluster endpoint of the Aurora database" is incorrect. The reader endpoint should be used when configuring Amazon RDS Proxy.

INCORRECT: "Configure an Amazon Aurora serverless database cluster and use automatic scaling" is incorrect. This will not help with connection management and may cause more latency.

INCORRECT: "Create a Gateway Load Balancer to distribute connections across the three Aurora Read Replicas" is incorrect. A GLB is used for routing traffic through managed virtual appliances such as IDS/IPS or firewalls.

References:

https://aws.amazon.com/rds/proxy/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Question 3Skipped

A company is moving their IT infrastructure to the AWS Cloud and will have several Amazon VPCs within an AWS Region. The company requires centralized and controlled egress-only internet access. The solution must be highly available and horizontally scalable. The company is expecting to grow the number of VPCs to more than fifty.

A Solutions Architect is designing the network for the new cloud deployment. Which design pattern will meet the stated requirements?

Attach each VPC to a shared centralized VPC. Configure VPC peering between each VPC and the centralized VPC. Configure a NAT gateway in two AZs within the centralized VPC.

Attach each VPC to a centralized transit VPC with a VPN connection to each standalone VPC. Outbound internet traffic will be controlled by firewall appliances.

Correct answer

Attach each VPC to a shared transit gateway. Use an egress VPC with firewall appliances in two AZs and connect the transit gateway using IPSec VPNs with BGP.

Attach each VPC to a shared transit gateway. Use an egress VPC with firewall appliances in two AZs and attach the transit gateway.

Overall explanation

A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks. You can attach the following to a transit gateway:

- One or more VPCs

- A Connect SD-WAN/third-party network appliance

- An AWS Direct Connect gateway

- A peering connection with another transit gateway

- A VPN connection to a transit gateway

The correct answer includes a VPN attachment with BGP for an AWS Transit Gateway. This allows BGP equal-cost multipathing (ECMP) to be used which can load balance traffic across multiple EC2 instances. This is the only solution that provides the ability to horizontally scale the outbound internet traffic across multiple appliances with HA across AZs.

The following diagram depicts this architecture:

CORRECT: "Attach each VPC to a shared transit gateway. Use an egress VPC with firewall appliances in two AZs and connect the transit gateway using IPSec VPNs with BGP" is the correct answer.

INCORRECT: "Attach each VPC to a shared transit gateway. Use an egress VPC with firewall appliances in two AZs and attach the transit gateway" is incorrect. Transit Gateway is not a load balancer and will not distribute your traffic evenly across instances in the two AZs. The traffic across the Transit Gateway will stay within an AZ, if possible. Therefore, you are limited by the bandwidth capabilities of a single EC2 instance.

INCORRECT: "Attach each VPC to a shared centralized VPC. Configure VPC peering between each VPC and the centralized VPC. Configure a NAT gateway in two AZs within the centralized VPC." is incorrect. Edge to edge routing is not supported for VPC peering so you cannot route across a VPC peering connection to VPC and then out via a NAT gateway.

INCORRECT: "Attach each VPC to a centralized transit VPC with a VPN connection to each standalone VPC. Outbound internet traffic will be controlled by firewall appliances" is incorrect. A transit VPC is a legacy design patter, AWS would prefer you to use AWS Transit Gateway for all new requirements. There is also no mention of how scaling and HA is included.

References:

https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-egress-to-internet.html

https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

Domain

AWS Networking & Content Delivery

Question 4Skipped

A company has created a service that they would like a customer to access. The service runs in the company’s AWS account and the customer has a separate AWS account. The company would like to enable the customer to establish least privilege security access using an API or command line tool to the customer account.

What is the MOST secure way to enable the customer to access the service?

The company should create an IAM role and assign the required permissions to the IAM role. The customer should then use the IAM role's Amazon Resource Name (ARN) when requesting access to perform the required tasks.

Correct answer

The company should create an IAM role and assign the required permissions to the IAM role. The customer should then use the IAM role's Amazon Resource Name (ARN), including the external ID in the IAM role's trust policy, when requesting access to perform the required tasks.

The company should create an IAM user and assign the required permissions to the IAM user. The company should then provide the credentials to the customer to log in and perform the required tasks.

The company should provide the customer with their AWS account access keys to log in and perform the required tasks.

Overall explanation

At times, you need to give a third-party access to your AWS resources (delegate access). One important aspect of this scenario is the External ID, optional information that you can use in an IAM role trust policy to designate who can assume the role.

To require that the third party provides an external ID when assuming a role, update the role's trust policy with the external ID of your choice.

To provide an external ID when you assume a role, use the AWS CLI or AWS API to assume that role.

The following diagram depicts this configuration:

CORRECT: "The company should create an IAM role and assign the required permissions to the IAM role. The customer should then use the IAM role's Amazon Resource Name (ARN), including the external ID in the IAM role's trust policy, when requesting access to perform the required tasks" is the correct answer.

INCORRECT: "The company should create an IAM role and assign the required permissions to the IAM role. The customer should then use the IAM role's Amazon Resource Name (ARN) when requesting access to perform the required tasks" is incorrect. This answer is missing the external ID which is required for security.

INCORRECT: "The company should provide the customer with their AWS account access keys to log in and perform the required tasks" is incorrect. Access keys should never be shared!

INCORRECT: "The company should create an IAM user and assign the required permissions to the IAM user. The company should then provide the credentials to the customer to log in and perform the required tasks" is incorrect. A role should be used rather than a user.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Security, Identity, & Compliance

Question 5Skipped

A company is updating their operating system patching processes. The company manages both on-premises servers and Amazon EC2 instances using multiple toolsets. A solutions architect wants to utilize a single tool for all servers and instances that can deploy patches and report on patch status.

Which set of actions should the solutions architect take to meet these requirements?

Use AWS Systems Manager Patch Manager to deploy patches on the EC2 instances and use Run Command for the on-premises servers. Use Systems Manager to generate patch compliance reports.

Use AWS OpsWorks to deploy patches on the on-premises servers and EC2 instances. Use Amazon Athena to generate patch compliance reports.

Use an Amazon EventBridge rule to apply patches by scheduling an AWS Systems Manager patch remediation job. Use Amazon Inspector to generate patch compliance reports.

Correct answer

Use AWS Systems Manager Patch Manager to deploy patches on the on-premises servers and EC2 instances. Use Systems Manager to generate patch compliance reports.

Overall explanation

AWS Systems Manager Patch Manager can be used for both on-premises servers and EC2 instances. Systems Manager can be configured for hybrid environments that include on-premises servers, edge devices, and virtual machines (VMs) that are configured for AWS Systems Manager, including VMs in other cloud environments.

There are several steps that must be taken to configure your on-premises nodes to be managed by AWS Systems Manager. Please refer to the link in the references below to learn more.

CORRECT: "Use AWS Systems Manager Patch Manager to deploy patches on the on-premises servers and EC2 instances. Use Systems Manager to generate patch compliance reports" is the correct answer (as explained above.)

INCORRECT: "Use AWS Systems Manager Patch Manager to deploy patches on the EC2 instances and use Run Command for the on-premises servers. Use Systems Manager to generate patch compliance reports" is incorrect. The patch manager capability of systems manager can be used for the on-premises servers and the EC2 instances, there is no need to use Run Command.

INCORRECT: "Use an Amazon EventBridge rule to apply patches by scheduling an AWS Systems Manager patch remediation job. Use Amazon Inspector to generate patch compliance reports" is incorrect. EventBridge is not needed as Systems Manager has its own capabilities for Patch Management. Systems Manager also has its own reporting, so Inspector is not needed here.

INCORRECT: "Use AWS OpsWorks to deploy patches on the on-premises servers and EC2 instances. Use Amazon Athena to generate patch compliance reports" is incorrect. OpsWorks is not the tool to use for deploying patches across servers and instances. Also, Athena runs queries against S3 buckets so the patch compliance data would need to be stored in S3 somehow.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-managedinstances.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 6Skipped

A company is using AWS CloudFormation templates for infrastructure provisioning. The templates are hosted in the company’s private GitHub repository. The company has experienced several issues with updates to the templates that have caused errors when executing the updates and creating the environment. A Solutions Architect must resolve these issues and implement automated testing of the CloudFormation template updates.

How can the Solutions Architect accomplish these requirements?

Correct answer

Use AWS CodePipeline to a create a change set when updates are made to the CloudFormation templates in GitHub. Include a CodePipeline action to test the deployment with testing scripts run using AWS CodeBuild. Upon successful testing, configure CodePipeline to execute the change set and deploy to production.

Use AWS Lambda to synchronize the contents of the GitHub repository to AWS CodeCommit. Use AWS CodeBuild to create and execute a change set from the templates in GitHub. Configure CodeBuild to test the deployment with testing scripts.

Use AWS Lambda to synchronize the contents of the GitHub repository to AWS CodeCommit. Use AWS CodeDeploy to create and execute a change set. Configure CodeDeploy to test the environment using testing scripts run by AWS CodeBuild.

Use AWS CodePipeline to a create and execute a change set when updates are made to the CloudFormation templates in GitHub. Include a CodePipeline action to test the deployment with testing scripts run using AWS CodeDeploy. Upon successful testing, configure CodePipeline to execute the change set and deploy to production.

Overall explanation

You can apply continuous delivery practices to your AWS CloudFormation stacks using AWS CodePipeline. AWS CodePipeline is a continuous delivery service for fast and reliable application and infrastructure updates. CodePipeline builds, tests, and deploys your code every time there is a code change, based on the release process models you define.

When using CloudFormation change sets you first create the change set which allows you to preview how proposed changes to a stack might impact your running resources. When you create a CloudFormation change set, it does not create a separate CloudFormation stack. Instead, it generates a preview of the changes that will be made to the existing stack when you decide to execute the change set. Then, once you’re happy with the changes the change set can be executed which will update the stack.

You can use AWS CodeBuild to both build and test code. CodeBuild can be configured with custom scripts to run tests and the result of the tests can determine the subsequent actions such as proceeding to deployment.

CORRECT: "Use AWS CodePipeline to a create a change set when updates are made to the CloudFormation templates in GitHub. Include a CodePipeline action to test the deployment with testing scripts run using AWS CodeBuild. Upon successful testing, configure CodePipeline to execute the change set and deploy to production" is the correct answer.

INCORRECT: "Use AWS CodePipeline to a create and execute a change set when updates are made to the CloudFormation templates in GitHub. Include a CodePipeline action to test the deployment with testing scripts run using AWS CodeDeploy. Upon successful testing, configure CodePipeline to execute the change set and deploy to production" is incorrect. CodeDeploy is used for deploying the updates but it is not used for running testing scripts.

INCORRECT: "Use AWS Lambda to synchronize the contents of the GitHub repository to AWS CodeCommit. Use AWS CodeDeploy to create and execute a change set. Configure CodeDeploy to test the environment using testing scripts run by AWS CodeBuild" is incorrect. CodePipeline should be used for creating and executing the change set and it can use a private GitHub repository so the first step is unnecessary. Testing should also successfully complete before execution of the change set.

INCORRECT: "Use AWS Lambda to synchronize the contents of the GitHub repository to AWS CodeCommit. Use AWS CodeBuild to create and execute a change set from the templates in GitHub. Configure CodeBuild to test the deployment with testing scripts" is incorrect. CodePipeline should be used for creating and executing the change set and it can use a private GitHub repository so the first step is unnecessary. Testing should also successfully complete before execution of the change set.

References:

https://aws.amazon.com/about-aws/whats-new/2016/11/continuously-deliver-changes-to-aws-cloudformation-stacks-with-aws-codepipeline/

https://docs.aws.amazon.com/codebuild/latest/userguide/how-to-create-pipeline.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-developer-tools-sap/

Domain

AWS Management & Governance

Question 7Skipped

A company has hundreds of accounts in AWS Organizations. There are several OUs for development teams that each contain multiple accounts. A manager requires that a report showing usage costs is generated for each development OU that shows all costs accrued by accounts within the OU.

Which solution meets these requirements?

Create an AWS Cost and Usage Report (CUR) by using AWS OpsWorks. Allow each team to visualize the CUR through AWS OpsWorks Stacks.

Correct answer

Create an AWS Cost and Usage Report (CUR) from the AWS Organizations management account. Allow each team to visualize the CUR through an Amazon QuickSight dashboard.

Create an AWS Cost and Usage Report (CUR) for each OU by using AWS Cost Explorer. Allow each team to visualize the CUR through an Amazon QuickSight dashboard.

Create an AWS Cost and Usage Report (CUR) in each AWS Organizations member account. Allow each team to visualize the CUR through an Amazon QuickSight dashboard.

Overall explanation

You can either generate a CUR from a management or member account. If you generate from member accounts then you must do this individually for each member account which will be a lot of work. In this case it would be better to generate the CUR from the management account of the organization and then use QuickSight to visualize it. Permissions can be granted to the manager of the development OUs to view data relating to the individual accounts in each OU.

CORRECT: "Create an AWS Cost and Usage Report (CUR) from the AWS Organizations management account. Allow each team to visualize the CUR through an Amazon QuickSight dashboard" is the correct answer (as explained above.)

INCORRECT: "Create an AWS Cost and Usage Report (CUR) in each AWS Organizations member account. Allow each team to visualize the CUR through an Amazon QuickSight dashboard" is incorrect. As explained above this would be a lot more work than using the management account to generate the CUR.

INCORRECT: "Create an AWS Cost and Usage Report (CUR) for each OU by using AWS Cost Explorer. Allow each team to visualize the CUR through an Amazon QuickSight dashboard" is incorrect. You cannot generate the CUR using AWS Cost Explorer.

INCORRECT: "Create an AWS Cost and Usage Report (CUR) by using AWS OpsWorks. Allow each team to visualize the CUR through AWS OpsWorks Stacks" is incorrect. OpsWorks has nothing to do with generating a cost and usage report.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/quicksight-cost-usage-report/

https://docs.aws.amazon.com/cur/latest/userguide/cur-consolidated-billing.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cost-management/

Domain

AWS Management & Governance

Question 8Skipped

A Solutions Architect has deployed an application on Amazon EC2 instances in a private subnet behind a Network Load Balancer (NLB) in a public subnet. Customers have attempted to connect from their office location and are unable to access the application. The targets were registered by instance-id and are all healthy in the associated target group.

What step should the Solutions Architect take to resolve the issue and enable access for the customers?

Check the security group for the NLB to ensure it allows ingress from the NLB elastic IP addresses.

Correct answer

Check the security group for the EC2 instances to ensure it allows ingress from the customer office.

Check the security group for the NLB to ensure it allows ingress from the EC2 instances’ security group.

Check the security group for the EC2 instances to ensure it allows ingress from the NLB subnets.

Overall explanation

The Solutions Architect should check that the security group of the EC2 instances is allowing inbound connections from the customer office IP ranges. Note that NLBs do not have security groups configured and pass connections straight to EC2 instances with the source IP of the client preserved (when registered by instance-id).

With NLBs, when you register EC2 instances as targets, you must ensure that the security groups for these instances allow traffic on both the listener port and the health check port. We know that the health check port is already configured correctly as the targets are all healthy.

CORRECT: "Check the security group for the EC2 instances to ensure it allows ingress from the customer office" is the correct answer.

INCORRECT: "Check the security group for the EC2 instances to ensure it allows ingress from the NLB subnets" is incorrect. This is not necessary as the source IPs of clients are preserved.

INCORRECT: "Check the security group for the NLB to ensure it allows ingress from the EC2 instances’ security group" is incorrect. The NLB security group does not receive incoming traffic from EC2, the traffic would come from the client.

INCORRECT: "Check the security group for the NLB to ensure it allows ingress from the NLB elastic IP addresses. There is no security group associated with an NLB. If using EIPs, these are associated with the nodes in the AZ but the NLB security group would not need to receive incoming traffic from the nodes.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/target-group-register-targets.html#target-security-groups

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Networking & Content Delivery

Question 9Skipped

A company has deployed two Microsoft Active Directory Domain Controllers into an Amazon VPC with a default configuration. The DHCP options set associated with the VPC has been configured to assign the IP addresses of the Domain Controllers as DNS servers. A VPC interface endpoint has been created but EC2 instances within the VPC are unable to resolve the private endpoint addresses.

Which strategies could a Solutions Architect use to resolve the issue? (Select TWO.)

Configure the DNS service on the EC2 instances in the VPC to use the VPC resolver server as the secondary DNS server.

Define an inbound Amazon Route 53 Resolver. Set a conditional forwarding rule for the Active Directory domain to the Active Directory servers. Configure the DNS settings in the VPC DHCP options set to use the AmazonProvidedDNS servers.

Correct selection

Define an outbound Amazon Route 53 Resolver. Set a conditional forwarding rule for the Active Directory domain to the Active Directory servers. Configure the DNS settings in the VPC DHCP options set to use the AmazonProvidedDNS servers.

Update the DNS service on the Active Directory servers to forward all queries to the VPC Resolver.

Correct selection

Update the DNS service on the Active Directory servers to forward all non-authoritative queries to the VPC Resolver.

Overall explanation

The EC2 instances are unable to resolve the DNS name of the VPC interface endpoint to an IP address as they are configured to use the Domain Controllers for DNS and the DCs do not have a record for the VCP interface endpoint.

There are two solutions to this problem that both achieve the same outcome. The first involves modifying the DNS service on the DCs to forward non-authoritative queries to the VPC resolver. This simply means if the DNS service on the DC does not have the record in its zone file it will forward the query to another DNS service.

The second solution uses an outbound Route 53 resolver. With outbound resolvers (but not with inbound resolvers) you can configure forwarding rules. In this case you would need to modify the EC2 instances (via the DHCP options set) to use the Amazon provided DNS servers. These servers would be able to resolve the VPC interface endpoint. The forwarding rule will forward any traffic for the Domain Controllers to those servers.

CORRECT: "Update the DNS service on the Active Directory servers to forward all non-authoritative queries to the VPC Resolver" is a correct answer.

CORRECT: "Define an outbound Amazon Route 53 Resolver. Set a conditional forwarding rule for the Active Directory domain to the Active Directory servers. Configure the DNS settings in the VPC DHCP options set to use the AmazonProvidedDNS servers" is also a correct answer.

INCORRECT: "Define an inbound Amazon Route 53 Resolver. Set a conditional forwarding rule for the Active Directory domain to the Active Directory servers. Configure the DNS settings in the VPC DHCP options set to use the AmazonProvidedDNS servers" is incorrect. You cannot configure a forwarding rule on an inbound resolver.

INCORRECT: "Configure the DNS service on the EC2 instances in the VPC to use the VPC resolver server as the secondary DNS server" is incorrect. A secondary DNS server is used as a backup for the primary DNS server that is configured on a client. It is not meant for splitting queries.

INCORRECT: "Update the DNS service on the Active Directory servers to forward all queries to the VPC Resolver" is incorrect. This would mean the DNS server on the DCs does not respond to queries from its own zone file as it will forward ALL queries to the VPC resolver.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-rules-managing.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 10Skipped

A company recently noticed an increase in costs associated with Amazon EC2 instances and Amazon RDS databases. The company needs to be able to track the costs. The company uses AWS Organizations for all of their accounts. AWS CloudFormation is used for deploying infrastructure and all resources are tagged. The management team has requested that cost center numbers and project ID numbers are added to all future EC2 instances and RDS databases.

What is the MOST efficient strategy a Solutions Architect should follow to meet these requirements?

Correct answer

Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID. Use SCPs to restrict the creation of resources that do not have the cost center and project ID tags specified.

Use an AWS Config rule to check for untagged resources. Create a centralized AWS Lambda based solution to tag untagged EC2 instances and RDS databases every hour using a cross-account role.

Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to activate.

Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to activate. Use permissions boundaries to restrict the creation of resources that do not have the cost center and project ID tags specified.

Overall explanation

You can use tags to organize your resources, and cost allocation tags to track your AWS costs on a detailed level. After you activate cost allocation tags, AWS uses the cost allocation tags to organize your resource costs on your cost allocation report, to make it easier for you to categorize and track your AWS costs.

By adding tags to all new resources, the management team will be better able to track costs and allocate costs to specific cost centers and projects.

Service Control Policies (SCPs) can be used to limit the maximum available permissions in an account in AWS Organizations. SCPs are policies and conditional statements can be added. In this case an SCP can be created with a conditional statement that only allows resources to be created if they have a tag specified.

CORRECT: "Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID. Use SCPs to restrict the creation of resources that do not have the cost center and project ID tags specified" is the correct answer.

INCORRECT: "Use an AWS Config rule to check for untagged resources. Create a centralized AWS Lambda based solution to tag untagged EC2 instances and RDS databases every hour using a cross-account role" is incorrect. AWS Config can be used for compliance but a better solution would be to enforce tags at creation time. Using Lambda to tag the resources would be complex in terms of identifying which tags to add to which resources.

INCORRECT: "Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to activate" is incorrect. There is no mechanism here to enforce application of tags.

INCORRECT: "Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to activate. Use permissions boundaries to restrict the creation of resources that do not have the cost center and project ID tags specified" is incorrect. Permissions boundaries apply to user accounts but SCPs apply to entire AWS accounts and will be easier to enforce for all users.

References:

https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Management & Governance

Question 11Skipped

A company is running a custom Java application on-premises and plans to migrate the application to the AWS Cloud. The application uses a MySQL database and the application servers maintain users’ sessions locally. Which combination of architecture changes will be required to create a highly available solution on AWS? (Select THREE.)

Correct selection

Configure the application to store the user's session in Amazon ElastiCache. Use Application Load Balancers to distribute the load between application instances.

Correct selection

Migrate the database to Amazon RDS for MySQL. Configure the RDS instance to use a Multi-AZ deployment.

Move the Java content to an Amazon S3 bucket configured for static website hosting. Configure cross-Region replication for the S3 bucket contents.

Migrate the database to Amazon EC2 instances in multiple Availability Zones. Configure Multi-AZ to synchronize the changes.

Correct selection

Put the application instances in an Amazon EC2 Auto Scaling group. Configure the Auto Scaling group to create new instances if an instance becomes unhealthy.

Configure the application to run in multiple Regions. Use an Application Load Balancer to distribute the load between application instances.

Overall explanation

To create a highly available application architecture on AWS the Solutions Architect can use Amazon EC2 Auto Scaling across multiple availability zones to ensure the application instances are available. The instances can be placed behind an ALB to distribute incoming connection requests between them.

For the database layer the MySQL database can be directly migrated to Amazon RDS with Multi-AZ which will provide fault tolerance. Additionally, Amazon ElastiCache can be used for storing session state data so the failure of an instance does not cause data to be lost.

CORRECT: "Configure the application to store the user's session in Amazon ElastiCache. Use Application Load Balancers to distribute the load between application instances" is a correct answer.

CORRECT: "Migrate the database to Amazon RDS for MySQL. Configure the RDS instance to use a Multi-AZ deployment" is also a correct answer.

CORRECT: "Put the application instances in an Amazon EC2 Auto Scaling group. Configure the Auto Scaling group to create new instances if an instance becomes unhealthy" is also a correct answer.

INCORRECT: "Migrate the database to Amazon EC2 instances in multiple Availability Zones. Configure Multi-AZ to synchronize the changes" is incorrect. You cannot configure Multi-AZ for databases running on EC2 instances as this is an RDS feature.

INCORRECT: "Move the Java content to an Amazon S3 bucket configured for static website hosting. Configure cross-Region replication for the S3 bucket contents" is incorrect. Static website hosting cannot be used for dynamic content.

INCORRECT: "Configure the application to run in multiple Regions. Use an Application Load Balancer to distribute the load between application instances" is incorrect. You cannot use an ELB to load balance between Regions, multiple AZs should be used instead.

References:

https://aws.amazon.com/getting-started/hands-on/building-fast-session-caching-with-amazon-elasticache-for-redis/

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Database

Question 12Skipped

An application runs on an Amazon EC2 instance with an attached Amazon EBS Provisioned IOPS (PIOPS) volume. The volume is configured at 200-GB in size and has 3,000 IOPS provisioned. The application requires low latency and random access to the data. A Solutions Architect has been asked to consider options for lowering the cost of the storage without impacting performance and durability.

What should the Solutions Architect recommend?

Create an Amazon EFS file system with the throughput mode set to Provisioned. Mount the EFS file system to the EC2 operating system.

Change the PIOPS volume for a 1-TB Throughput Optimized HDD (st1) volume.

Correct answer

Change the PIOPS volume for a 1-TB EBS General Purpose SSD (gp2) volume.

Create an Amazon EFS file system with the performance mode set to Max I/O. Mount the EFS file system to the EC2 operating system.

Overall explanation

The most cost-effective solution is to use an Amazon EBS General Purpose SSD (gp2) volume. The volume should be configured with 1-TB as gp2 volumes provide 3 IOPS per GB, which will allow the full 3,000 IOPS to be achieved.

CORRECT: "Change the PIOPS volume for a 1-TB EBS General Purpose SSD (gp2) volume" is the correct answer.

INCORRECT: "Change the PIOPS volume for a 1-TB Throughput Optimized HDD (st1) volume" is incorrect. This volume type supports a maximum of 500 IOPS per volume.

INCORRECT: "Create an Amazon EFS file system with the performance mode set to Max I/O. Mount the EFS file system to the EC2 operating system" is incorrect. EFS will be much more expensive than using a gp2 volume.

INCORRECT: "Create an Amazon EFS file system with the throughput mode set to Provisioned. Mount the EFS file system to the EC2 operating system" is incorrect. EFS will be much more expensive than using a gp2 volume.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

Domain

AWS Storage

Question 13Skipped

A company operates a mobile application that enables users to upload images for processing. The app experiences a surge in usage, with thousands of uploads per minute, primarily between 8 AM and 5 PM on weekdays, and minimal activity at other times. Users receive notifications when their image processing is complete.

To effectively manage this variable load and ensure scalable image processing, which three steps should a solutions architect implement? (Select THREE.)

Correct selection

Configure the mobile app to send image uploads directly to Amazon S3. Configure S3 to trigger an Amazon Simple Queue Service (Amazon SQS) standard queue message upon each upload.

Correct selection

Use Amazon Simple Notification Service (Amazon SNS) to send push notifications to the mobile app once the image processing is finished.

Correct selection

Implement an AWS Lambda function that initiates image processing in response to messages in the SQS queue.

Activate an S3 Batch Operations job to handle image processing based on queue messages.

Direct image uploads from the mobile app to Amazon S3 and use S3 event notifications to place messages in an Amazon MQ queue for subsequent processing.

Use Amazon Simple Email Service (Amazon SES) to send notifications to the mobile app after the completion of image processing tasks.

Overall explanation

The combination of Amazon S3 for image uploads, Amazon SQS for queuing, and AWS Lambda for processing forms a highly scalable and efficient serverless architecture, ideal for handling variable workloads. By uploading images directly to Amazon S3, the mobile app leverages S3's robustness and scalability for data storage.

S3's event notification feature then plays a critical role, as it automatically posts messages to an Amazon SQS standard queue upon each image upload. This integration ensures that the image processing workload is queued efficiently, particularly important during peak usage times.

The use of a standard SQS queue is crucial here, as it can handle a high throughput of messages, maintaining the order of image uploads and ensuring that no messages are lost, even under heavy load.

The second part of the solution involves AWS Lambda, which is triggered by messages in the SQS queue to process the images. Lambda's serverless nature allows it to scale automatically with the number of upload requests, providing a cost-effective solution that matches the application's demand patterns.

This setup ensures that image processing starts promptly after each upload, handling the bursts of activity during peak hours without the need for manual scaling. Finally, Amazon SNS is used to notify users upon the completion of image processing.

SNS provides a reliable way to send real-time notifications to the mobile app, enhancing the user experience by promptly informing users when their images are ready.

This end-to-end solution effectively addresses the challenge of variable loads, ensuring that the system remains responsive and cost-efficient regardless of the number of uploads at any given time.

CORRECT: "Configure the mobile app to send image uploads directly to Amazon S3. Configure S3 to trigger an Amazon Simple Queue Service (Amazon SQS) standard queue message upon each upload" is a correct answer (as explained above.)

CORRECT: "Implement an AWS Lambda function that initiates image processing in response to messages in the SQS queue" is also a correct answer (as explained above.)

CORRECT: "Use Amazon Simple Notification Service (Amazon SNS) to send push notifications to the mobile app once the image processing is finished" is also a correct answer (as explained above.)

INCORRECT: "Direct image uploads from the mobile app to Amazon S3 and use S3 event notifications to place messages in an Amazon MQ queue for subsequent processing" is incorrect.

While Amazon MQ is a message broker service for Apache ActiveMQ and RabbitMQ, it's more complex and typically used for migrating existing message brokers to AWS. For new applications, especially those requiring high scalability, Amazon SQS is generally more appropriate.

INCORRECT: "Activate an S3 Batch Operations job to handle image processing based on queue messages" is incorrect.

S3 Batch Operations is designed for performing large-scale batch operations on S3 objects, not for real-time, event-driven tasks like image processing. This approach would not provide the necessary responsiveness or scalability for the described use case.

INCORRECT: "Use Amazon Simple Email Service (Amazon SES) to send notifications to the mobile app after the completion of image processing tasks" is incorrect.

Amazon SES is primarily an email service and would not be the best choice for sending real-time push notifications to a mobile app. Amazon SNS is more suited for this purpose, offering a broader range of notification options including push notifications.

References:

https://docs.aws.amazon.com/lambda/latest/dg/with-s3.html

https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html

Domain

AWS Application Integration

Question 14Skipped

A company is planning to build a high-performance computing (HPC) solution in the AWS Cloud. The solution will include a 10-node cluster running Linux. High speed and low latency inter-instance connectivity is required to optimize the performance of the cluster.

Which combination of steps will meet these requirements? (Choose two.)

Correct selection

Deploy Amazon EC2 instances in a cluster placement group.

Use Amazon EC2 instances that support burstable performance.

Deploy instances across at least three Availability Zones.

Deploy Amazon EC2 instances in a partition placement group.

Correct selection

Use Amazon EC2 instance types and AMIs that support EFA.

Overall explanation

A cluster placement group is a logical grouping of instances within a single Availability Zone. A cluster placement group can span peered VPCs in the same Region. Instances in the same cluster placement group enjoy a higher per-flow throughput limit for TCP/IP traffic and are placed in the same high-bisection bandwidth segment of the network.

Cluster placement groups are recommended for applications that benefit from low network latency, high network throughput, or both. They are also recommended when the majority of the network traffic is between the instances in the group.

An Elastic Fabric Adapter (EFA) is a network device that you can attach to your Amazon EC2 instance to accelerate High Performance Computing (HPC) and machine learning applications. EFA enables you to achieve the application performance of an on-premises HPC cluster, with the scalability, flexibility, and elasticity provided by the AWS Cloud.

CORRECT: "Deploy Amazon EC2 instances in a cluster placement group" is a correct answer.

CORRECT: "Use Amazon EC2 instance types and AMIs that support EFA" is also a correct answer.

INCORRECT: "Deploy instances across at least three Availability Zones" is incorrect. This will increase latency between instances which is bad for HPC applications.

INCORRECT: "Deploy Amazon EC2 instances in a partition placement group" is incorrect. Partition placement groups are recommended for applications that are distributed and replicated. It does not provide the optimum latency and throughput required by an HPC application.

INCORRECT: "Use Amazon EC2 instances that support burstable performance" is incorrect. This feature provides bursts of CPU performance but in this scenario low latency and high throughput is required between instances and burstable CPUs do not assist with this.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html#placement-groups-cluster

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/efa.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Compute

Question 15Skipped

A company provides a service that allows users to upload high-resolution product images using an app on their phones for a price matching service. The service currently uses Amazon S3 in the us-west-1 Region. The company has expanded to Europe and users in European countries are experiencing significant delays when uploading images.

Which combination of changes can a Solutions Architect make to improve the upload times for the images? (Select TWO.)

Correct selection

Redeploy the application to use Amazon S3 multipart upload.

Create an Amazon CloudFront distribution with the S3 bucket as an origin.

Configure the client application to use byte-range fetches.

Modify the Amazon S3 bucket to use Intelligent Tiering.

Correct selection

Configure the S3 bucket to use S3 Transfer Acceleration.

Overall explanation

Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between a client and an S3 bucket. Transfer Acceleration takes advantage of Amazon CloudFront’s globally distributed edge locations. As the data arrives at an edge location, data is routed to Amazon S3 over an optimized network path.

Transfer Acceleration is a good solution for the following use cases:

- You have customers that upload to a centralized bucket from all over the world.

- You transfer gigabytes to terabytes of data on a regular basis across continents.

- You are unable to utilize all of your available bandwidth over the Internet when uploading to Amazon S3.

Multipart upload transfers parts of the file in parallel and can speed up performance. This should definitely be built into the application code. Multipart upload also handles the failure of any parts gracefully, allowing for those parts to be retransmitted.

Transfer Acceleration in combination with multipart upload will offer significant speed improvements when uploading data.

CORRECT: "Configure the S3 bucket to use S3 Transfer Acceleration" is the correct answer.

CORRECT: "Redeploy the application to use Amazon S3 multipart upload" is correct.

INCORRECT: "Create an Amazon CloudFront distribution with the S3 bucket as an origin" is incorrect. CloudFront can offer performance improvements for downloading data but to improve upload transfer times, Transfer Acceleration should be used.

INCORRECT: "Configure the client application to use byte-range fetches" is incorrect. This is a technique that is used when reading (not writing) data to fetch only the parts of the file that are required.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/optimizing-performance.html

https://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html

https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-migration-sap/

Domain

AWS Storage

Question 16Skipped

A healthcare company with several AWS accounts is looking to enhance its data security posture. A recent internal review highlighted numerous Amazon S3 buckets containing sensitive patient data that are not encrypted. The company needs a systematic approach to encrypt these existing S3 buckets and ensure future compliance across all AWS accounts.

The company also seeks a centralized management solution for its AWS accounts with a focus on security and regulatory compliance.

Which two actions should the solutions architect take to address these requirements? (Select TWO.)

Correct selection

Establish an AWS Organizations structure, implement AWS Control Tower, and activate the necessary security guardrails. Consolidate all AWS accounts under this organization and organize them into Organizational Units (OUs) based on their function.

Implement a cross-account AWS CloudTrail logging solution. Use Amazon Athena queries to periodically scan for unencrypted S3 buckets and trigger S3 bucket encryption.

Set up AWS Organizations and enable AWS Security Hub for centralized security monitoring. Use AWS Config rules to detect and automatically encrypt unencrypted S3 buckets.

Utilize AWS CLI scripts to iterate through all S3 buckets across the AWS accounts, identify unencrypted buckets, and enable default encryption on them.

Correct selection

Create an AWS Lambda function triggered by Amazon EventBridge to monitor and automatically apply encryption to any newly created or existing unencrypted S3 buckets.

Overall explanation

Setting up AWS Organizations and implementing AWS Control Tower provides a centralized governance framework for managing multiple AWS accounts. By activating security guardrails, the company can enforce policies and best practices, including ensuring that S3 buckets are encrypted, thus maintaining compliance, and enhancing security across all accounts.

An AWS Lambda function, triggered by Amazon EventBridge, can be used to automate the process of detecting and encrypting unencrypted S3 buckets. This solution ensures that both existing and new S3 buckets are encrypted, thereby securing sensitive data, and adhering to compliance requirements with minimal manual intervention.

CORRECT: "Establish an AWS Organizations structure, implement AWS Control Tower, and activate the necessary security guardrails. Consolidate all AWS accounts under this organization and organize them into Organizational Units (OUs) based on their function" is a correct answer (as explained above.)

CORRECT: "Create an AWS Lambda function triggered by Amazon EventBridge to monitor and automatically apply encryption to any newly created or existing unencrypted S3 buckets" is also a correct answer (as explained above.)

INCORRECT: "Utilize AWS CLI scripts to iterate through all S3 buckets across the AWS accounts, identify unencrypted buckets, and enable default encryption on them" is incorrect.

While using AWS CLI scripts to identify and enable encryption on unencrypted S3 buckets is a viable approach, it doesn't address the requirement for centralized management and compliance across multiple AWS accounts. It lacks the centralized governance and automation provided by AWS Control Tower and EventBridge-based Lambda functions.

INCORRECT: "Set up AWS Organizations and enable AWS Security Hub for centralized security monitoring. Use AWS Config rules to detect and automatically encrypt unencrypted S3 buckets" is incorrect.

This answer mentions AWS Security Hub and AWS Config rules, which are valuable tools for security monitoring and compliance checks. However, it doesn't specifically address the requirement for automatically encrypting unencrypted S3 buckets. While AWS Config can be used to detect compliance violations, it typically relies on other services, like AWS Lambda, to take corrective actions. Additionally, the answer lacks the mention of a Lambda function, which is crucial for automation in this context.

INCORRECT: "Implement a cross-account AWS CloudTrail logging solution. Use Amazon Athena queries to periodically scan for unencrypted S3 buckets and trigger S3 bucket encryption" is incorrect.

This answer suggests implementing a cross-account AWS CloudTrail solution to monitor activities in different AWS accounts, and then using Amazon Athena queries to scan for unencrypted S3 buckets and trigger encryption. While CloudTrail can help monitor activities and events, and Amazon Athena can be used for querying data, this approach is complex and may not directly address the requirement for a centralized and automated solution to encrypt unencrypted volumes. It also focuses on S3 bucket encryption, which is not the same as encrypting Amazon EBS volumes.

References:

https://aws.amazon.com/organizations/

https://aws.amazon.com/controltower/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 17Skipped

A company utilizing Amazon Connect for their contact center is encountering a surge in automated calls, affecting both operational costs and agent productivity. They need a system where agents can easily mark a call as spam, subsequently preventing such numbers from being routed to agents in the future.

What is the most effective and operationally efficient solution for this scenario?

Develop a special feature in the Amazon Connect CCP that allows agents to transfer spam calls to a designated queue. This queue triggers an AWS Lambda function to add the caller's number to a spam list in Amazon DynamoDB, with contact flows adjusted to check this list for incoming calls.

Introduce a voice command feature in the Amazon Connect CCP for agents to verbally mark calls as spam. This command activates an AWS Lambda function to record the number in an Amazon DynamoDB table, and the contact flow is modified to use this table for blocking subsequent calls from these numbers.

Correct answer

Add a custom 'flag as spam' button to the Contact Control Panel (CCP) in Amazon Connect. This button triggers an AWS Lambda function to update call attributes and log the number in an Amazon DynamoDB table. Adapt the contact flows to reference these attributes and interact with the DynamoDB table for future call filtering.

Implement a machine learning model within Amazon Connect to automatically detect and flag spam calls. Store these numbers in an Amazon DynamoDB table and configure contact flows to use an AWS Lambda function for consulting this table to block future spam calls.

Overall explanation

This solution is operationally efficient as it integrates directly into the existing Amazon Connect CCP, allowing agents to mark calls as spam with a simple button click.

The use of AWS Lambda ensures automated processing, and Amazon DynamoDB provides a scalable way to store and retrieve spam numbers.

By modifying the contact flows to reference the updated attributes and DynamoDB table, the system can effectively prevent future calls from flagged numbers, enhancing productivity and reducing costs.

CORRECT: "Add a custom 'flag as spam' button to the Contact Control Panel (CCP) in Amazon Connect. This button triggers an AWS Lambda function to update call attributes and log the number in an Amazon DynamoDB table. Adapt the contact flows to reference these attributes and interact with the DynamoDB table for future call filtering" is the correct answer (as explained above.)

INCORRECT: "Implement a machine learning model within Amazon Connect to automatically detect and flag spam calls. Store these numbers in an Amazon DynamoDB table and configure contact flows to use an AWS Lambda function for consulting this table to block future spam calls" is incorrect.

While a machine learning model could potentially automate the detection of spam calls, implementing and maintaining such a system requires significant resources and expertise. It may not be as operationally efficient compared to a simpler, direct solution like a custom button in the CCP.

INCORRECT: "Develop a special feature in the Amazon Connect CCP that allows agents to transfer spam calls to a designated queue. This queue triggers an AWS Lambda function to add the caller's number to a spam list in Amazon DynamoDB, with contact flows adjusted to check this list for incoming calls" is incorrect.

Creating a special feature for transferring spam calls to a designated queue adds additional steps to the agent's workflow and may not be as immediate or straightforward as directly flagging a call as spam. This could lead to inefficiencies in handling calls.

INCORRECT: "Introduce a voice command feature in the Amazon Connect CCP for agents to verbally mark calls as spam. This command activates an AWS Lambda function to record the number in an Amazon DynamoDB table, and the contact flow is modified to use this table for blocking subsequent calls from these numbers" is incorrect.

Introducing a voice command feature for marking spam calls is an innovative approach but may face challenges in terms of accuracy and ease of use, especially in a noisy call center environment. This might not be as reliable or efficient as a more traditional interface-based solution.

References:

https://aws.amazon.com/connect/features/

Domain

AWS Management & Governance

Question 18Skipped

A company has deployed a new application into an Amazon VPC that does not have Internet access. The company has connected an AWS Direct Connection (DX) private VIF to the VPC and all communications will be over the DX connection. A new requirement states that all data in transit must be encrypted between users and the VPC.

Which strategy should a Solutions Architect use to maintain consistent network performance while meeting this new requirement?

Create a new private virtual interface for the existing DX connection, and create a new VPN that connects to the VPC over the DX private virtual interface.

Correct answer

Create a new public virtual interface for the existing DX connection, and create a new VPN that connects to the VPC over the DX public virtual interface.

Create a new Site-to-Site VPN that connects to the VPC over the internet.

Create a client VPN endpoint and configure the users’ computers to use an AWS client VPN to connect to the VPC over the Internet.

Overall explanation

Running an AWS VPN connection over a DX connection provides consistent levels of throughput and encryption algorithms that protect your data. Though a private VIF is typically used to connect to a VPC, in the case of running an IPSec VPN over the top of a DX connection it is necessary to use a public VIF (please check the AWS article linked below for instructions)

CORRECT: "Create a new public virtual interface for the existing DX connection, and create a new VPN that connects to the VPC over the DX public virtual interface" is the correct answer.

INCORRECT: "Create a new private virtual interface for the existing DX connection, and create a new VPN that connects to the VPC over the DX private virtual interface" is incorrect. A public VIF must be used when using an IPSec VPN over a DX connection.

INCORRECT: "Create a client VPN endpoint and configure the users’ computers to use an AWS client VPN to connect to the VPC over the Internet" is incorrect. This does not maintain consistent network performance as the public internet offers variable performance.

INCORRECT: "Create a new Site-to-Site VPN that connects to the VPC over the internet" is incorrect. This does not maintain consistent network performance as the public internet offers variable performance. The DX connection should be utilized.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/create-vpn-direct-connect/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 19Skipped

A company uses multiple AWS accounts. There are separate accounts for development, staging, and production environments. Some new requirements have been issued to control costs and improve the overall governance of the AWS accounts. The company must be able to calculate costs associated with each project and each environment. Commonly deployed IT services must be centrally managed and business units should be restricted to deploying pre-approved IT services only.

Which combination of actions should be taken to meet these requirements? (Select TWO.)

Configure custom budgets and define thresholds using AWS Cost Explorer.

Correct selection

Apply environment, cost center, and application name tags to all resources that accept tags.

Use AWS Savings Plans to configure budget thresholds and send alerts to management.

Use Amazon CloudWatch to create a billing alarm that notifies managers when a billing threshold is reached or exceeded.

Correct selection

Create an AWS Service Catalog portfolio for each business unit and add products to the portfolios using AWS CloudFormation templates.

Overall explanation

AWS Service Catalog enables organizations to create and manage catalogs of IT services that are approved for AWS. These IT services can include everything from virtual machine images, servers, software, and databases to complete multi-tier application architectures.

AWS Service Catalog allows organizations to centrally manage commonly deployed IT services, and helps organizations achieve consistent governance and meet compliance requirements. End users can quickly deploy only the approved IT services they need, following the constraints set by the organization.

To track the costs associated with projects and environments cost allocation tags should be applied to the relevant resources. Cost allocation tags are used to track AWS costs on a detailed level. After you activate cost allocation tags, AWS uses the cost allocation tags to organize your resource costs on your cost allocation report, to make it easier for you to categorize and track your AWS costs.

CORRECT: "Apply environment, cost center, and application name tags to all resources that accept tags" is a correct answer.

CORRECT: "Create an AWS Service Catalog portfolio for each business unit and add products to the portfolios using AWS CloudFormation templates" is also a correct answer.

INCORRECT: "Configure custom budgets and define thresholds using AWS Cost Explorer" is incorrect. Cost Explorer is used for viewing cost related information but not for creating budgets.

INCORRECT: "Use AWS Savings Plans to configure budget thresholds and send alerts to management" is incorrect as this is not a service but a pricing model and cannot be used for sending alerts.

INCORRECT: "Use Amazon CloudWatch to create a billing alarm that notifies managers when a billing threshold is reached or exceeded" is incorrect. There is no requirement to create billing alarms specified in the scenario.

References:

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/introduction.html

https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Cost Management

Question 20Skipped

A Solutions Architect has deployed an application on Amazon EC2 instances in a private subnet behind a Network Load Balancer (NLB) in a public subnet. The NLB has not been associated with a security group. Customers have attempted to connect from their office location and are unable to access the application. The targets were registered by instance-id and are all healthy in the associated target group.

What step should the Solutions Architect take to resolve the issue and enable access for the customers?

Check the security group for the NLB to ensure it allows ingress from the NLB elastic IP addresses.

Correct answer

Check the security group for the EC2 instances to ensure it allows ingress from the customer office.

Check the security group for the NLB to ensure it allows ingress from the EC2 instances’ security group.

Check the security group for the EC2 instances to ensure it allows ingress from the NLB subnets.

Overall explanation

The Solutions Architect should check that the security group of the EC2 instances is allowing inbound connections from the customer office IP ranges. When the target is registered by instance-id, NLBs pass connections straight to EC2 instances with the source IP of the client preserved.

With NLBs, when you register EC2 instances as targets, you must ensure that the security groups for these instances allow traffic on both the listener port and the health check port. We know that the health check port is already configured correctly as the targets are all healthy.

CORRECT: "Check the security group for the EC2 instances to ensure it allows ingress from the customer office" is the correct answer.

INCORRECT: "Check the security group for the EC2 instances to ensure it allows ingress from the NLB subnets" is incorrect. This is not necessary as the source IPs of clients are preserved.

INCORRECT: "Check the security group for the NLB to ensure it allows ingress from the EC2 instances’ security group" is incorrect. The NLB security group does not receive incoming traffic from EC2, the traffic would come from the client.

INCORRECT: "Check the security group for the NLB to ensure it allows ingress from the NLB elastic IP addresses. There is no security group associated with the NLB. If using EIPs, these are associated with the nodes in the AZ but the NLB security group would not need to be configured to receive incoming traffic from the nodes.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/target-group-register-targets.html#target-security-groups

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Networking & Content Delivery

Question 21Skipped

A company has deployed an application on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB). The ALB is configured as the origin in an Amazon CloudFront distribution. The company requires that the solution is secured against web-based attacks. An AWS WAF web ACL has been created and associated with the CloudFront distribution. The company must prevent anyone from circumventing the CloudFront distribution and connecting directly to the ALB.

Which solution will meet these requirements with the LEAST operational overhead?

Correct answer

Add a security group rule to the ALB to allow traffic from the AWS managed prefix list for CloudFront only.

Add a security group rule to the ALB to allow only the various CloudFront IP address ranges.

Create network ACL that denies access to all IP address blocks except the various CloudFront IP address ranges.

Create a new web ACL that blocks access the application. Associate the new web ACL with the ALB.

Overall explanation

You can use the managed prefix list for CloudFront as a part of your inbound rules in security groups that you attach to your origin resources, such as your EC2 instances or Application Load Balancers. The AWS-managed prefix lists are created and maintained by AWS and are available to use at no additional cost.

You can reference the managed prefix list for CloudFront in your (Amazon VPC) security group rules. In this case the configuration would only allow access to the ALB with the source set to the prefix list for CloudFront. This solution requires the least operational overhead to maintain.

CORRECT: "Add a security group rule to the ALB to allow traffic from the AWS managed prefix list for CloudFront only" is the correct answer (as explained above.)

INCORRECT: "Add a security group rule to the ALB to allow only the various CloudFront IP address ranges" is incorrect. This would require a lot of operational overhead to maintain as the IP address ranges will change over time.

INCORRECT: "Create a new web ACL that blocks access the application. Associate the new web ACL with the ALB" is incorrect. This is not the most cost-effective solution and may also block access from the CloudFront distribution.

INCORRECT: "Create network ACL that denies access to all IP address blocks except the various CloudFront IP address ranges" is incorrect. This would require a lot of overhead to maintain as the IP ranges for CloudFront change over time.

References:

https://aws.amazon.com/blogs/networking-and-content-delivery/limit-access-to-your-origins-using-the-aws-managed-prefix-list-for-amazon-cloudfront/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 22Skipped

A company runs an application that generates user activity reports and stores them in an Amazon S3 bucket. Users are able to download the reports using the application which generates a signed URL. A user recently reported that the reports of other users can be accessed directly from the S3 bucket. A Solutions Architect reviewed the bucket permissions and discovered that public access is currently enabled.

How can the documents be protected from unauthorized access without modifying the application workflow?

Correct answer

Use the Block Public Access feature in Amazon S3 to set the IgnorePublicAcls option to TRUE on the bucket.

Use the Block Public Access feature in Amazon S3 to set the BlockPublicPolicy option to TRUE on the bucket.

Configure server access logging and monitor the log files to check for unauthorized access.

Modify the settings on the S3 bucket to enable default encryption for all objects.

Overall explanation

The S3 bucket is allowing public access and this must be immediately disabled. Setting the IgnorePublicAcls option to TRUE causes Amazon S3 to ignore all public ACLs on a bucket and any objects that it contains.

The other settings you can configure with the Block Public Access Feature are:

- BlockPublicAcls – PUT bucket ACL and PUT objects requests are blocked if granting public access.

- BlockPublicPolicy – Rejects requests to PUT a bucket policy if granting public access.

- RestrictPublicBuckets – Restricts access to principles in the bucket owners’ AWS account.

CORRECT: "Use the Block Public Access feature in Amazon S3 to set the IgnorePublicAcls option to TRUE on the bucket" is the correct answer.

INCORRECT: "Use the Block Public Access feature in Amazon S3 to set the BlockPublicPolicy option to TRUE on the bucket" is incorrect. This option will only reject requests to PUT a bucket policy that grants public access which is not relevant to the workflow in this scenario.

INCORRECT: "Configure server access logging and monitor the log files to check for unauthorized access" is incorrect. This will only identify unauthorized access; it does not block it.

INCORRECT: "Modify the settings on the S3 bucket to enable default encryption for all objects" is incorrect. Encryption will not prevent public access; it just encrypts the data at rest in the S3 bucket.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

Domain

AWS Storage

Question 23Skipped

A company is deploying a web service that will provide read and write access to structured data. The company expects there to be variable usage patterns with some short but significant spikes. The service must dynamically scale and must be fault tolerant across multiple AWS Regions.

Which actions should a Solutions Architect take to meet these requirements?

Correct answer

Store the data in an Amazon DynamoDB global table in two Regions using on-demand capacity mode. Run the web service in both Regions as Amazon ECS Fargate tasks in an Auto Scaling ECS service behind an Application Load Balancer (ALB). In Amazon Route 53, configure an alias record and a latency-based routing policy with health checks to distribute traffic between the two ALBs.

Store the data in Amazon S3 buckets in two Regions and configure cross-Region replication. Create an Amazon CloudFront distribution that points to multiple origins. Use Amazon API Gateway and AWS Lambda for the web frontend and configure Amazon Route 53 with an alias record pointing to the REST API.

Store the data in Amazon DocumentDB in two Regions. Use AWS DMS to synchronize data between databases. Run the web service on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in each Region. In Amazon Route 53, configure an alias record and a failover routing policy.

Store the data in Amazon Aurora global databases. Add Auto Scaling replicas to both Regions. Run the web service on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in each Region. In Amazon Route 53, configure an alias record and a multi-value routing policy.

Overall explanation

The DynamoDB global tables solution is the only database solution that will allow writes in both AWS Regions. Using Amazon ECS Fargate tasks with Auto Scaling will ensure the compute layer scales appropriately and an ALB will distribute connections across multiple tasks.

This solution is active-active and so a latency-based routing policy will direct users to the closest Region to improve performance. Health checks are enabled which means that if a Region outage occurs, traffic will be directed to the second Region.

CORRECT: "Store the data in an Amazon DynamoDB global table in two Regions using on-demand capacity mode. Run the web service in both Regions as Amazon ECS Fargate tasks in an Auto Scaling ECS service behind an Application Load Balancer (ALB). In Amazon Route 53, configure an alias record and a latency-based routing policy with health checks to distribute traffic between the two ALBs" is correct.

INCORRECT: "Store the data in Amazon Aurora global databases. Add Auto Scaling replicas to both Regions. Run the web service on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in each Region. In Amazon Route 53, configure an alias record and a multi-value routing policy" is incorrect. Aurora global databases provide read access in multiple Regions but writes can only be made in one Region. In this solution the multi-value routing policy will direct connections to healthy ALBs in both Regions and so any attempts to write in a Region without that capability will fail.

INCORRECT: "Store the data in Amazon DocumentDB in two Regions. Use AWS DMS to synchronize data between databases. Run the web service on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in each Region. In Amazon Route 53, configure an alias record and a failover routing policy" is incorrect. DocumentDB is used for storing JSON data not structured data so is not suitable.

INCORRECT: "Store the data in Amazon S3 buckets in two Regions and configure cross-Region replication. Create an Amazon CloudFront distribution that points to multiple origins. Use Amazon API Gateway and AWS Lambda for the web frontend and configure Amazon Route 53 with an alias record pointing to the REST API" is incorrect. When using CloudFront with multiple origins, behaviors must be configured to direct traffic to a specific origin, this would not work when the content is the same – it does not function as a load balancer or provide automatic failover.

References:

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GlobalTables.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

Domain

AWS Database

Question 24Skipped

A financial services company is implementing AWS Lambda functions to connect to an Amazon Aurora MySQL database cluster. These Lambda functions will be utilized in both a development environment for testing and a live production environment.

The company's priority is to ensure that database credentials are not hardcoded within the Lambda functions and that there's a system in place for the automated rotation of passwords.

Which solution will fulfill these requirements?

Save the database credentials in AWS KMS for both environments and enable automatic key rotation. Use environment variables in the Lambda functions to reference the stored AWS KMS credentials. Assign appropriate IAM roles to the Lambda functions for accessing AWS KMS.

Establish distinct Amazon S3 buckets for development and production environments. Enable server-side encryption using AWS KMS keys (SSE-KMS) for both buckets. Implement a file naming convention that allows Lambda functions to dynamically fetch the appropriate credentials based on their environment. Ensure the execution roles of the Lambda functions have the necessary permissions to access the respective S3 buckets.

Correct answer

Configure AWS Secrets Manager for managing the database credentials, creating separate secret keys for the development and production environments. Enable automatic secret rotation. Pass the Secrets Manager secret ARNs to the Lambda functions through environment variables. Assign appropriate IAM roles to the Lambda functions for accessing the secrets.

Utilize AWS Systems Manager Parameter Store to manage database credentials for both the development and production environments. Encrypt these credentials using an AWS KMS key. Modify the Lambda functions' code to retrieve credentials from the Parameter Store using the AWS SDK for JavaScript. Assign appropriate IAM roles to the Lambda functions for accessing the Parameter Store.

Overall explanation

AWS Secrets Manager is specifically designed to handle secrets like database credentials. It provides built-in support for rotating credentials safely and seamlessly, without the need for embedded credentials in the application code.

Using separate secrets for different environments (development and production) ensures that the credentials are environment-specific, enhancing security.

The use of environment variables to pass Secrets Manager ARNs to Lambda functions is a secure and efficient way to provide access to the required credentials without hardcoding them.

CORRECT: "Configure AWS Secrets Manager for managing the database credentials, creating separate secret keys for the development and production environments. Enable automatic secret rotation. Pass the Secrets Manager secret ARNs to the Lambda functions through environment variables. Assign appropriate IAM roles to the Lambda functions for accessing the secrets" is the correct answer (as explained above.)

INCORRECT: "Utilize AWS Systems Manager Parameter Store to manage database credentials for both the development and production environments. Encrypt these credentials using an AWS KMS key. Modify the Lambda functions' code to retrieve credentials from the Parameter Store using the AWS SDK for JavaScript. Assign appropriate IAM roles to the Lambda functions for accessing the Parameter Store" is incorrect.

While the AWS Systems Manager Parameter Store is a viable option for storing configuration data and secrets, it does not have the built-in automatic rotation feature for secrets, which is crucial in this scenario.

INCORRECT: "Save the database credentials in AWS KMS for both environments and enable automatic key rotation. Use environment variables in the Lambda functions to reference the stored AWS KMS credentials. Assign appropriate IAM roles to the Lambda functions for accessing AWS KMS" is incorrect.

AWS KMS is primarily used for creating and managing cryptographic keys and is not suited for storing application-level secrets like database credentials. Additionally, KMS does not offer a feature to rotate database credentials.

INCORRECT: "Establish distinct Amazon S3 buckets for development and production environments. Enable server-side encryption using AWS KMS keys (SSE-KMS) for both buckets. Implement a file naming convention that allows Lambda functions to dynamically fetch the appropriate credentials based on their environment. Ensure the execution roles of the Lambda functions have the necessary permissions to access the respective S3 buckets" is incorrect.

Using S3 buckets to store credentials is not a recommended practice. This approach can lead to security risks as S3 is primarily for object storage and does not have the built-in capability to manage secrets or rotate them securely. Furthermore, it complicates the management and retrieval of credentials, especially when compared to services like AWS Secrets Manager and Parameter Store.

References:

https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-secrets-manager/

Domain

AWS Security, Identity, & Compliance

Question 25Skipped

A Solutions Architect is migrating an application to AWS Fargate. The task runs in a private subnet and does not have direct connectivity to the internet. When the Fargate task is launched, it fails with the following error:

CannotPullContainerError: API error (500): Get https://111122223333.dkr.ecr.us-east-1.amazonaws.com/v2/: net/http: request canceled while waiting for connection"

What should the Solutions Architect do to correct the error?

Enable dual-stack in the Amazon ECS account settings and configure the network for the task to use awsvpc.

Correct answer

Specify DISABLED for Auto-assign public IP when launching the task and configure a NAT gateway in a public subnet to route requests to the internet.

Specify ENABLED for Auto-assign public IP when launching the task.

Specify DISABLED for Auto-assign public IP when launching the task and configure a NAT gateway in a private subnet to route requests to the internet.

Overall explanation

When a Fargate task is launched, its elastic network interface requires a route to the internet to pull container images. If you receive an error similar to the following when launching a task, it is because a route to the internet does not exist:

CannotPullContainerError: API error (500): Get https://111122223333.dkr.ecr.us-east-1.amazonaws.com/v2/: net/http: request canceled while waiting for connection"

To resolve this issue, you can:

- For tasks in public subnets, specify ENABLED for Auto-assign public IP when launching the task.

- For tasks in private subnets, specify DISABLED for Auto-assign public IP when launching the task, and configure a NAT gateway in your VPC to route requests to the internet.

CORRECT: "Specify DISABLED for Auto-assign public IP when launching the task and configure a NAT gateway in a public subnet to route requests to the internet" is the correct answer.

INCORRECT: "Specify DISABLED for Auto-assign public IP when launching the task and configure a NAT gateway in a private subnet to route requests to the internet" is incorrect. The NAT Gateway should be in a public subnet.

INCORRECT: "Specify ENABLED for Auto-assign public IP when launching the task" is incorrect. This will not work as the task is running in a private subnet and will not pick up a public IP.

INCORRECT: "Enable dual-stack in the Amazon ECS account settings and configure the network for the task to use awsvpc" is incorrect. This is used to enable IPv6 for a task but that is not required in this situation.

References:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_cannot_pull_image.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

Domain

AWS Compute

Question 26Skipped

A company is planning to migrate an application from an on-premises data center to the AWS Cloud. The application consists of a stateful servers and a separate MySQL database. The application is expected to receive significant traffic and must scale seamlessly. The solution design on AWS includes an Amazon Aurora MySQL database, Amazon EC2 Auto Scaling and Elastic Load Balancing.

A Solutions Architect needs to finalize the design for the solution. Which of the following configurations will ensure a consistent user experience and seamless scalability for both the application and database tiers?

Add Aurora Replicas and define a scaling policy. Use an Application Load Balancer and set the load balancing algorithm type to least_outstanding_requests.

Correct answer

Add Aurora Replicas and define a scaling policy. Use an Application Load Balancer and set the load balancing algorithm type to round_robin.

Add Aurora Replicas and define a scaling policy. Use a Network Load Balancer and set the load balancing algorithm type to round_robin.

Add Aurora Replicas and define a scaling policy. Use a Network Load Balancer and set the load balancing algorithm type to least_outstanding_requests.

Overall explanation

Aurora Auto Scaling dynamically adjusts the number of Aurora Replicas provisioned for an Aurora DB cluster using single-master replication. You define and apply a scaling policy to an Aurora DB cluster.

The scaling policy defines the minimum and maximum number of Aurora Replicas that Aurora Auto Scaling can manage. Based on the policy, Aurora Auto Scaling adjusts the number of Aurora Replicas up or down in response to actual workloads, determined by using Amazon CloudWatch metrics and target values.

By default, the round robin routing algorithm is used to route requests at the target group level. You can specify the least outstanding requests routing algorithm instead.

Consider using least outstanding requests when the requests for your application vary in complexity or your targets vary in processing capability. Round robin is a good choice when the requests and targets are similar, or if you need to distribute requests equally among targets.

In this case the round robin algorithm will be the best choice as the instances will have the same processing capability and requests should be routed evenly between them.

CORRECT: "Add Aurora Replicas and define a scaling policy. Use an Application Load Balancer and set the load balancing algorithm type to round_robin" is the correct answer.

INCORRECT: "Add Aurora Replicas and define a scaling policy. Use an Application Load Balancer and set the load balancing algorithm type to least_outstanding_requests" is incorrect. The least outstanding requests algorithm is not the best choice here as explained above.

INCORRECT: "Add Aurora Replicas and define a scaling policy. Use a Network Load Balancer and set the load balancing algorithm type to least_outstanding_requests" is incorrect. The NLB does not use this algorithm, it uses a flow hash algorithm.

INCORRECT: "Add Aurora Replicas and define a scaling policy. Use a Network Load Balancer and set the load balancing algorithm type to round_robin" is incorrect. The NLB does not use this algorithm, it uses a flow hash algorithm.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Integrating.AutoScaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

Domain

AWS Database

Question 27Skipped

A company has an NFS file server on-premises with 50 TB of data that is being migrated to Amazon S3. The data is made up of many millions of small and files and a Snowball Edge device is being used for the migration. A shell script is being used to copy data using the file interface of the Snowball Edge device. Data transfer times are very slow and the Solutions Architect suspects this may be related to the overhead of encrypting all the small files and copying them over the network.

What change should be made to improve data transfer times?

Cluster two Snowball Edge devices together to increase the throughput of the devices.

Correct answer

Perform multiple copy operations at one time by running each command from a separate terminal window, in separate instances of the Snowball client.

Modify the shell script to ensure that individual files are being copied rather than directories.

Connect directly to the USB interface on the Snowball Edge device and copy the files locally.

Overall explanation

In general, you can improve the transfer speed from your data source to the Snowball in the following ways, ordered from largest to smallest positive impact on performance:

1. Use the latest Mac or Linux Snowball client

2. Batch small files together

3. Perform multiple copy operations at one time

4. Copy from multiple workstations

5. Transfer directories, not files

Option 3 entails performing multiple snowball cp commands at one time. You can do this by running each command from a separate terminal window, in separate instances of the Snowball client, all connected to the same Snowball.

CORRECT: "Perform multiple copy operations at one time by running each command from a separate terminal window, in separate instances of the Snowball client" is the correct answer.

INCORRECT: "Modify the shell script to ensure that individual files are being copied rather than directories" is incorrect. This is the opposite of what you should do to improve performance. Copy directories rather than individual files

INCORRECT: "Connect directly to the USB interface on the Snowball Edge device and copy the files locally" is incorrect. The Snowball Edge device does not come with a USB interface. It has SFP, QSFP, and RJ45 connections for Ethernet networking.

INCORRECT: "Cluster two Snowball Edge devices together to increase the throughput of the devices" is incorrect. You cannot cluster these devices for throughput.

References:

https://docs.aws.amazon.com/snowball/latest/ug/performance.html

https://docs.aws.amazon.com/snowball/latest/developer-guide/specifications.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-migration-sap/

Domain

AWS Migration & Transfer

Question 28Skipped

A company operates a large-scale workload with numerous Amazon EC2 instances within a VPC, which includes both public and private subnets. The public subnets are currently configured with a route to an internet gateway for IPv4 traffic (0.0.0.0/0), while the private subnets route IPv4 traffic (0.0.0.0/0) to a NAT gateway. The company now plans to transition its EC2 instances to IPv6, ensuring that instances in private subnets remain inaccessible from the public internet.

To achieve this IPv6 migration while adhering to the specified network accessibility requirements, what actions should the solutions architect take?

Correct answer

Modify the existing VPC to include an Amazon-provided IPv6 CIDR block for the VPC and its subnets. For the public subnets, update the route tables to route IPv6 traffic (::/0) to the internet gateway. For the private subnets, update the route tables to route IPv6 traffic (::/0) to an egress-only internet gateway.

Modify the VPC to include an Amazon-provided IPv6 CIDR block for both the VPC and its subnets. For the public and private subnets, adjust the route tables to direct IPv6 traffic (::/0) through the existing NAT gateway.

Modify the current VPC configuration by adding a custom IPv6 CIDR block to the VPC and all its subnets. Establish an egress-only internet gateway and update the route tables of the public and private subnets to include a route for IPv6 traffic (::/0) to this gateway.

Modify the current VPC configuration by adding a custom IPv6 CIDR block for the VPC and its subnets. Implement a new IPv6-enabled NAT gateway and update the route tables for the private subnets to route IPv6 traffic (::/0) through this new gateway.

Overall explanation

Incorporating an Amazon-provided IPv6 CIDR block into the VPC and its subnets enables IPv6 support across the entire network infrastructure.

For public subnets, routing IPv6 traffic (::/0) to the internet gateway allows instances in these subnets to send and receive IPv6 traffic from the internet, maintaining their public accessibility.

For private subnets, using an egress-only internet gateway for IPv6 traffic ensures that instances can initiate outbound IPv6 connections while remaining inaccessible from the public internet.

This dual approach maintains the necessary security posture for private subnet instances and provides the required public internet connectivity for instances in public subnets, aligning with the IPv6 migration objectives.

CORRECT: "Modify the existing VPC to include an Amazon-provided IPv6 CIDR block for the VPC and its subnets. For the public subnets, update the route tables to route IPv6 traffic (::/0) to the internet gateway. For the private subnets, update the route tables to route IPv6 traffic (::/0) to an egress-only internet gateway" is the correct answer (as explained above.)

INCORRECT: "Modify the VPC to include an Amazon-provided IPv6 CIDR block for both the VPC and its subnets. For the public and private subnets, adjust the route tables to direct IPv6 traffic (::/0) through the existing NAT gateway" is incorrect.

NAT gateways in AWS do not support IPv6 traffic. Therefore, using the existing NAT gateway for IPv6 traffic is not a viable solution. Also, you cannot use NAT gateways for the instances in the public subnet, they should be directed via the internet gateway.

INCORRECT: "Modify the current VPC configuration by adding a custom IPv6 CIDR block to the VPC and all its subnets. Establish an egress-only internet gateway and update the route tables of the public and private subnets to include a route for IPv6 traffic (::/0) to this gateway" is incorrect.

While using an egress-only internet gateway is correct, AWS does not allow the association of custom IPv6 CIDR blocks with a VPC. IPv6 CIDR blocks must be provided by Amazon.

INCORRECT: "Modify the current VPC configuration by adding a custom IPv6 CIDR block for the VPC and its subnets. Implement a new IPv6-enabled NAT gateway and update the route tables for the private subnets to route IPv6 traffic (::/0) through this new gateway" is incorrect.

Currently, AWS NAT gateways do not support IPv6 traffic. Therefore, this option is not feasible for handling IPv6 traffic in AWS.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html#vpc-ipv6

https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 29Skipped

A company currently manages a fleet of Amazon EC2 instances running Windows and Linux in public and private subnets. The operations team currently connects over the Internet to manage the instances as there is no connection to the corporate network.

Security groups have been updated to allow the RDP and SSH protocols from any source IPv4 address. There have been reports of malicious attempts to access the resources as the company wishes to implement the most secure solution for managing the instances.

Which strategy should a Solutions Architect recommend?

Correct answer

Deploy the AWS Systems Manager Agent on the EC2 instances. Access the EC2 instances using Session Manager restricting access to users with permission to manage the instances.

Deploy a server on the corporate network that can be used for managing EC2 instances. Update the security groups to allow connections over SSH and RDP from the on-premises management server only.

Configure an IPSec Virtual Private Network (VPN) connecting the corporate network to the Amazon VPC. Update security groups to allow connections over SSH and RDP from the corporate network only.

Deploy a Linux bastion host with an Elastic IP address in the public subnet. Allow access to the bastion host from 0.0.0.0/0.

Overall explanation

The most secure option presented is to use AWS Systems Manager Session Manager. Session Manager is a fully managed AWS Systems Manager capability that lets you manage Amazon EC2 instances, on-premises instances, and virtual machines (VMs) through an interactive one-click browser-based shell or through the AWS Command Line Interface (AWS CLI).

Session Manager provides secure and auditable instance management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys. Session Manager also makes it easy to comply with corporate policies that require controlled access to instances, strict security practices, and fully auditable logs with instance access details, while still providing end users with simple one-click cross-platform access to your managed instances.

CORRECT: "Deploy the AWS Systems Manager Agent on the EC2 instances. Access the EC2 instances using Session Manager restricting access to users with permission to manage the instances" is the correct answer.

INCORRECT: "Deploy a server on the corporate network that can be used for managing EC2 instances. Update the security groups to allow connections over SSH and RDP from the on-premises management server only" is incorrect. This is less secure compared to using session manager as the SSH and RDP ports must still be open on instances and it does not offer the robust controls offered by session manager.

INCORRECT: "Deploy a Linux bastion host with an Elastic IP address in the public subnet. Allow access to the bastion host from 0.0.0.0/0" is incorrect. This is less secure compared to using session manager as the SSH and RDP ports must still be open on instances and it does not offer the robust controls offered by session manager. This solution could be better secured by restricting access to the corporate IP ranges.

INCORRECT: "Configure an IPSec Virtual Private Network (VPN) connecting the corporate network to the Amazon VPC. Update security groups to allow connections over SSH and RDP from the corporate network only" is incorrect. This is less secure compared to using session manager as the SSH and RDP ports must still be open on instances and it does not offer the robust controls offered by session manager.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Management & Governance

Question 30Skipped

A company plans to build a gaming application in the AWS Cloud that will be used by Internet-based users. The application will run on a single instance and connections from users will be made over the UDP protocol. The company has requested that the service is implemented with a high level of security. A Solutions Architect has been asked to design a solution for the application on AWS.

Which combination of steps should the Solutions Architect take to meet these requirements? (Select THREE.)

Correct selection

Use a Network Load Balancer (NLB) in front of the application instance. Use a friendly DNS entry in Amazon Route 53 pointing to the NLB's Elastic IP address.

Correct selection

Configure a network ACL rule to block all non-UDP traffic. Associate the network ACL with the subnets that hold the load balancer instances.

Use AWS Global Accelerator with an Elastic Load Balancer as an endpoint.

Use an Application Load Balancer (ALB) in front of the application instance. Use a friendly DNS entry in Amazon Route 53 pointing to the ALB's internet-facing fully qualified domain name (FQDN).

Correct selection

Enable AWS Shield Advanced on all public-facing resources.

Define an AWS WAF rule to explicitly drop non-UDP traffic and associate the rule with the load balancer.

Overall explanation

The Network Load Balancer (NLB) supports the UDP protocol and can be placed in front of the application instance. This configuration may add some security if the instance is running in a private subnet.

An NLB can be configured with an Elastic IP in each subnet in which it has nodes. In this case it only has a single subnet (one instance) and so there will be 1 EIP.

Route 53 can be configured to resolve directly to the EIP rather than the DNS name of the NLB as there is only one IP address to return. To filter traffic the network ACL for the subnet can be configured to block all non-UDP traffic.

This solution meets all the stated requirements.

CORRECT: "Use a Network Load Balancer (NLB) in front of the application instance. Use a friendly DNS entry in Amazon Route 53 pointing to the NLB's Elastic IP address" is a correct answer.

CORRECT: "Configure a network ACL rule to block all non-UDP traffic. Associate the network ACL with the subnets that hold the load balancer instances" is also a correct answer.

CORRECT: "Enable AWS Shield Advanced on all public-facing resources" is also a correct answer.

INCORRECT: "Use an Application Load Balancer (ALB) in front of the application instance. Use a friendly DNS entry in Amazon Route 53 pointing to the ALB's internet-facing fully qualified domain name (FQDN)" is incorrect. An ALB only listens for HTTP and HTTPS traffic which uses the TCP protocol. It does not support UDP.

INCORRECT: "Define an AWS WAF rule to explicitly drop non-UDP traffic and associate the rule with the load balancer" is incorrect. WAF is unnecessary as a network ACL can filter the traffic.

INCORRECT: "Use AWS Global Accelerator with an Elastic Load Balancer as an endpoint" is incorrect. AWS Global Accelerator provides improved performance and high availability when you have copies of your application running in multiple AWS Regions. It is not required in this solution.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Security, Identity, & Compliance

Question 31Skipped

A company has a large photo library stored on Amazon S3. They use AWS Lambda to extract metadata from the files according to various processing rules for different categories of photo. The output is then stored in an Amazon DynamoDB table.

The extraction process is performed whenever customer requests are submitted and can take up to 60 minutes to complete. The company wants to reduce the time taken to extract the metadata and has split the single Lambda function into separate Lambda functions for each category of photo.

Which additional steps should the Solutions Architect take to meet the requirements?

Create an AWS Batch compute environment for each Lambda function. Configure an AWS Batch job queue for the compute environment. Create a Lambda function to retrieve a list of files and write each item to the job queue.

Create an AWS Step Functions workflow to run the Lambda functions in parallel. Create another Step Functions workflow that retrieves a list of files and executes a metadata extraction workflow for each one.

Create a Lambda function to retrieve a list of files and write each item to an Amazon SQS queue. Subscribe the metadata extraction Lambda functions to the SQS queue with a large batch size.

Correct answer

Create an AWS Step Functions workflow to run the Lambda functions in parallel. Create a Lambda function to retrieve a list of files and write each item to an Amazon SQS queue. Configure a Lambda function to retrieve messages from the SQS queue and call the StartExecution API.

Overall explanation

The best solution presented is to use a combination of AWS Step Functions and Amazon SQS. This results in each Lambda function being able to run in parallel and use a queue for buffering the jobs. A Lambda function is required to retrieve messages from the queue. The information from the messages can then be used as input to the parallel functions that form the workflow using the StartExecution API.

CORRECT: "Create an AWS Step Functions workflow to run the Lambda functions in parallel. Create a Lambda function to retrieve a list of files and write each item to an Amazon SQS queue. Configure a Lambda function to retrieve messages from the SQS queue and call the StartExecution API" is the correct answer.

INCORRECT: "Create an AWS Step Functions workflow to run the Lambda functions in parallel. Create another Step Functions workflow that retrieves a list of files and executes a metadata extraction workflow for each one" is incorrect. There is no need for two Step Functions workflows, it is better to use one workflow and an SQS queue for storing the lists of files to be processed.

INCORRECT: "Create an AWS Batch compute environment for each Lambda function. Configure an AWS Batch job queue for the compute environment. Create a Lambda function to retrieve a list of files and write each item to the job queue" is incorrect. This would be a more costly way to process the files as Batch uses EC2 resources. It would be more cost-effective to use Lambda functions in a Step Functions workflow.

INCORRECT: "Create a Lambda function to retrieve a list of files and write each item to an Amazon SQS queue. Subscribe the metadata extraction Lambda functions to the SQS queue with a large batch size" is incorrect. The workflow is missing to coordinate the function execution. Using Step Functions can organize the execution of the metadata extraction process.

References:

https://aws.amazon.com/step-functions/features/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-application-integration-sap/

Domain

AWS Application Integration

Question 32Skipped

A Solution Architect used the AWS Application Discovery Service to gather information about some on-premises database servers. The tool discovered an Oracle data warehouse and several MySQL databases. The company plans to migrate to AWS and the Solutions Architect must determine the best migration pattern for each database.

Which combination of migration patterns will reduce licensing costs and operational overhead? (Select TWO.)

Correct selection

Migrate the MySQL databases to Amazon RDS for MySQL using AWS DMS.

Correct selection

Migrate the Oracle data warehouse to Amazon Redshift using AWS SCT and AWS DMS.

Lift and shift the Oracle data warehouse to Amazon EC2 using AWS Snowball.

Migrate the Oracle data warehouse to an Amazon ElastiCache for Redis cluster using AWS DMS.

Lift and shift the MySQL databases to Amazon EC2 using AWS Snowball.

Overall explanation

In this scenario we must determine the best platform to run each database on and the best migration path to get there. Cost and operational overhead must be minimized.

The best solution for an Oracle data warehouse is to migrate it to Amazon RedShift which is a managed service that is designed to run data warehouses (relational DB for OLAP use cases). This will require the schema to be modified which means AWS SCT should be used, and AWS DMS can migrate the actual data.

For the MySQL databases these can be run on Amazon RDS for MySQL. This will provide a managed service and does not require modifications to the schema. Therefore, AWS DMS can be used without AWS SCT.

CORRECT: "Migrate the Oracle data warehouse to Amazon Redshift using AWS SCT and AWS DMS" is a correct answer.

CORRECT: "Migrate the MySQL databases to Amazon RDS for MySQL using AWS DMS" is also a correct answer.

INCORRECT: "Lift and shift the Oracle data warehouse to Amazon EC2 using AWS Snowball" is incorrect. There is no indication that bandwidth is an issue or the database is particularly large. Therefore, Snowball is not required. Also Amazon EC2 does not reduce operational overhead.

INCORRECT: "Lift and shift the MySQL databases to Amazon EC2 using AWS Snowball" is incorrect. Amazon EC2 does not reduce operational overhead so is not the best choice. As with the previous explanation, there’s no indication that Snowball is required.

INCORRECT: "Migrate the Oracle data warehouse to an Amazon ElastiCache for Redis cluster using AWS DMS" is incorrect. ElastiCache is mainly used for caching data in-memory from other databases and is not the best choice for a data warehouse. Also, SCT would be needed to modify the schema.

References:

https://aws.amazon.com/getting-started/hands-on/migrate-oracle-to-amazon-redshift/

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/migrate-an-on-premises-mysql-database-to-amazon-rds-for-mysql.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-migration-sap/

Domain

AWS Migration & Transfer

Question 33Skipped

A developer is attempting to access an Amazon S3 bucket in a member account in AWS Organizations. The developer is logged in to the account with user credentials and has received an access denied error with no bucket listed. The developer should have read-only access to all buckets in the account.

A Solutions Architect has reviewed the permissions and found that the developer's IAM user has been granted read-only access to all S3 buckets in the account.

Which additional steps should the Solutions Architect take to troubleshoot the issue? (Select TWO.)

Correct selection

Check the SCPs set at the organizational units (OUs).

Check the bucket policies for all S3 buckets.

Check the ACLs for all S3 buckets.

Check if an appropriate IAM role is attached to the IAM user.

Correct selection

Check for the permissions boundaries set for the IAM user.

Overall explanation

A service control policy (SCP) may have been implemented that limits the API actions that are available for Amazon S3. This will apply to all users in the account regardless of the permissions they have assigned to their user account.

Another potential cause of the issue is that the permissions boundary for the user limits the S3 API actions available to the user. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. An entity's permissions boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries.

CORRECT: "Check the SCPs set at the organizational units (OUs)" is a correct answer.

CORRECT: "Check for the permissions boundaries set for the IAM user" is also a correct answer.

INCORRECT: "Check if an appropriate IAM role is attached to the IAM user" is incorrect. The question states that the user is logged in with a user account so is not assuming a role.

INCORRECT: "Check the bucket policies for all S3 buckets" is incorrect. The user has not been granted access to any buckets, and the error does not list access denied to any specific bucket. Therefore, it is more likely that the user is not been granted the API action to list the buckets.

INCORRECT: "Check the ACLs for all S3 buckets" is incorrect. With a bucket ACL the grantee is an AWS account or one of the predefined groups. With an ACL you can grant read/write at the bucket level but list is restricted to the object level so would not apply to the bucket itself. The user has been unable to list any buckets in this case so an ACL is unlikely to be the cause.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Management & Governance

Question 34Skipped

A Solutions Architect needs to design the architecture for an application that requires high availability within and across AWS Regions. The design must support failover to the second Region within 1 minute and must minimize the impact on the user experience. The application will include three tiers, the web tier, application tier and NoSQL data tier.

Which combination of steps will meet these requirements? (Select THREE.)

Use an Amazon Route 53 weighted routing policy set to 100/0 across the two selected Regions. Set Time to Live (TTL) to 30 minutes.

Run the web and application tiers in both Regions in an active/active configuration. Use Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use Spot Instances for the required resources.

Correct selection

Run the web and application tiers in both Regions in an active/passive configuration. Use Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use zonal Reserved Instances for the minimum number of servers and On-Demand Instances for any additional resources.

Use an Amazon Aurora global database across both Regions so reads and writes can occur either location.

Correct selection

Use an Amazon Route 53 failover routing policy for failover from the primary Region to the disaster recovery Region. Set Time to Live (TTL) to 30 seconds.

Correct selection

Use Amazon DynamoDB with a global table across both Regions so reads and writes can occur in either location.

Overall explanation

The requirements can be achieved by using an Amazon DynamoDB database with a global table. DynamoDB is a NoSQL database so it fits the requirements. A global table also allows both reads and writes to occur in both Regions.

For the web and application tiers Auto Scaling groups should be configured. Due to the 1-minute RTO these must be configured in an active/passive state. The best pricing model to lower price but ensure resources are available when needed is to use a combination of zonal reserved instances and on-demand instances.

To failover between the Regions, a Route 53 failover routing policy can be configured with a TTL configured on the record of 30 seconds. This will mean clients must resolve against Route 53 every 30 seconds to get the latest record. In a failover scenario the clients would be redirected to the secondary site if the primary site is unhealthy.

CORRECT: "Use an Amazon Route 53 failover routing policy for failover from the primary Region to the disaster recovery Region. Set Time to Live (TTL) to 30 seconds" is a correct answer.

CORRECT: "Use Amazon DynamoDB with a global table across both Regions so reads and writes can occur in either location" is also a correct answer.

CORRECT: "Run the web and application tiers in both Regions in an active/passive configuration. Use Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use zonal Reserved Instances for the minimum number of servers and On-Demand Instances for any additional resources" is also a correct answer.

INCORRECT: "Use an Amazon Route 53 weighted routing policy set to 100/0 across the two selected Regions. Set Time to Live (TTL) to 30 minutes" is incorrect. A weighted routing policy would need to be updated to change the weightings and the TTL here is too high as clients will cache the result for 30 minutes.

INCORRECT: "Use an Amazon Aurora global database across both Regions so reads and writes can occur either location" is incorrect. An Aurora database is a relational DB, not a NoSQL DB. Also, Aurora global database does not allow writes in multiple Regions, only reads.

INCORRECT: "Run the web and application tiers in both Regions in an active/active configuration. Use Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use Spot Instances for the required resources" is incorrect. Spot instances may not be available if the maximum price configured is exceeded. This could result in instances not being available when needed.

References:

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GlobalTables.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-configuring.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 35Skipped

A company uses Amazon RedShift for analytics. Several teams deploy and manage their own RedShift clusters and management has requested that the costs for these clusters is better managed. The management team has set budgets and once the budgetary thresholds have been reached a notification should be sent to a distribution list for managers. Teams should be able to view their RedShift cluster’s expenses to date. A Solutions Architect needs to create a solution that ensures the policy is centrally enforced in a multi-account environment.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

Correct selection

Create an AWS Service Catalog portfolio for each team. Add each team's Amazon RedShift cluster as an AWS CloudFormation template to their Service Catalog portfolio as a Product.

Create an Amazon CloudWatch metric for billing. Create a custom alert when costs exceed the budgetary threshold.

Create an AWS CloudTrail trail that tracks data events. Configure Amazon CloudWatch to monitor the trail and trigger an alarm when billing metrics exceed a certain threshold.

Correct selection

Update the AWS CloudFormation template to include the AWS::Budgets::Budget::resource with the NotificationsWithSubscribers property.

Install the unified CloudWatch Agent on the RedShift cluster hosts. Track the billing metric data in CloudWatch and trigger an alarm when a threshold is reached.

Overall explanation

You can use AWS Budgets to track your service costs and usage within AWS Service Catalog. You can associate budgets with AWS Service Catalog products and portfolios.

AWS Budgets gives you the ability to set custom budgets that alert you when your costs or usage exceed (or are forecasted to exceed) your budgeted amount.

If a budget is associated to a product, you can view information about the budget on the Products and Product details page. If a budget is associated to a portfolio, you can view information about the budget on the Portfolios and Portfolio details page.

When you click on a product or portfolio, you are taken to a detail page. These Portfolio detail and Product detail pages have a section with detailed information about the associated budget. You can see the budgeted amount, current spend, and forecasted spend. You also have the option to view budget details and edit the budget.

CORRECT: "Update the AWS CloudFormation template to include the AWS::Budgets::Budget::resource with the NotificationsWithSubscribers property" is a correct answer.

CORRECT: "Create an AWS Service Catalog portfolio for each team. Add each team's Amazon RedShift cluster as an AWS CloudFormation template to their Service Catalog portfolio as a Product" is also a correct answer.

INCORRECT: "Install the unified CloudWatch Agent on the RedShift cluster hosts. Track the billing metric data in CloudWatch and trigger an alarm when a threshold is reached" is incorrect. This agent is used on EC2 instances for sending additional metric data and logs to CloudWatch. However, it is not used for budgeting.

INCORRECT: "Create an AWS CloudTrail trail that tracks data events. Configure Amazon CloudWatch to monitor the trail and trigger an alarm when billing metrics exceed a certain threshold" is incorrect. CloudTrail tracks API calls, it cannot be used for tracking billing data.

INCORRECT: "Create an Amazon CloudWatch metric for billing. Create a custom alert when costs exceed the budgetary threshold" is incorrect. Billing data is automatically collected, you cannot create a metric for billing but you can create an alarm.

References:

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_budgets.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-budgets-budget.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Database

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries