AWS Certified Solutions Architect Professional Practice Exam

Practice Test 5: AWS Certified Solutions Architect Professional
Open

Practice Test 4: AWS Certified Solutions Architect…

Practice Test 6: AWS Certified Solutions Architect…

Set a certification due date

AWS Certified Solutions Architect – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: AWS Certified Solutions Architect Professional

Start

Practice Test 2: AWS Certified Solutions Architect Professional

Start

Practice Test 3: AWS Certified Solutions Architect Professional

Start

Practice Test 4: AWS Certified Solutions Architect Professional

Start

Start

Practice Test 6: AWS Certified Solutions Architect Professional

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] AWS Certified Solutions Architect Professional Practice Test Questions [SAP-C02] Exam Simulator + Explanations

Rating: 4.2 out of 54.2
1,847 ratings

35,250

Students

210 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified Solutions Architect Professional exam the first time with a great score

EXAM SIMULATION: All Practice Tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

REFERENCE LINKS: To help you understand the AWS concepts, all answers link to our online Training Notes (Cheat Sheets) with exam-specific information

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

MASTER THE CLOUD: Learn how to answer challenging scenario-based questions

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ALWAYS UP TO DATE: Our question bank is constantly updated based on student feedback from the latest SAP-C02 exam. New questions are added on a regular basis

ACTIVE Q&A FORUM: Our discussion board provides a platform for students to ask questions, share their recent exam experiences, and offer feedback on exam topics

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Show moreShow less

Description

Are you preparing for the AWS Certified Solutions Architect Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS Solutions Architect Professional practice exams to assess your exam-readiness!

These Practice Exams are the best way to prepare for your AWS Certified Solutions Architect Professional exam as they accurately reflect the style and level of difficulty of the real Amazon Web Services exam questions.

This course includes 6 sets of AWS practice tests and each practice test has 30 unique practice questions to optimize your study time. All questions are unique and 100% aligned with the latest AWS SAP-C02 exam blueprint.

SAP-C02 is a challenging exam that includes many long and complex questions that test deep knowledge of many AWS services. We've extracted the core topics from the latest exam blueprint and created this practice exam course that prepares you like no other. This training is your secret weapon to achieving this highly regarded AWS certification.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Don't just take our word for it – check out our reviews which confirm that our AWS practice questions closely match the exam pattern and difficulty. These practice tests will prepare you thoroughly for the real exam giving you the confidence you need to take and pass the AWS Certified Solutions Architect Pro exam.

This SAP-C02 practice test course includes:

180 exam-style questions with detailed answers and explanations to reinforce your understanding of the core concepts

Test report that highlights the areas you need to focus on

Regular updates to reflect the latest exam content

Realistic exam simulation to help you build confidence in your ability to pass your exam

Free bonus material to help you succeed in your exam

THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST SAP-C02 EXAM: Practice Tests are 100% scenario-based reflecting the current AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

DEEP DIVE REFERENCE LINKS: Our practice tests offer more than just answers – they link to relevant sections of our online "Training Notes," providing you with a comprehensive collection of exam-specific information for the AWS Solutions Architect Professional exam

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

LIFETIME ACCESS TO ALL FUTURE UPDATES: We're constantly improving and updating the questions based on exam feedback from thousands of our students.

REGULAR UPDATES: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

ADDITIONAL LEARNING RESOURCES: To help you succeed in your exam, we've included free learning material (optional, requires name/email) that complements the course content

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the actual AWS exam has a passing score of 75%, we recommend that you retake our AWS practice exams until you consistently score 80% or higher. It's important to put in the effort and study the online training notes in detail. Once you achieve the recommended score in our practice tests, you'll be well-prepared to sit the AWS exam and achieve a remarkable score.

GET FAMILIAR WITH EXAM FORMAT: Our AWS Solutions Architect Professional practice exams help you get familiar with the test question format and structure, giving you an edge in the actual AWS exam. While many practice tests in the market do not match the exam pattern format, you can trust that our practice tests will thoroughly prepare you for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS Solutions Architect Pro practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Solutions Architect Pro certification exam with confidence.

WHAT DO OTHER STUDENTS SAY?

Our practice tests are widely regarded as the best, providing you with the preparation you need to confidently pass your AWS Certified Solutions Architect Professional exam with a great score. But don't just take our word for it – check out the excellent course reviews from our happy students, who achieved an average passing score of over 850!

"I’ve literally just taken the AWS Solutions Architect Professional examination and I’d just like to say that the questions in this course are the most accurate I’ve ever come across"

"I am elated to share that I have passed my Solution Architect Professional! Thank you for these practice exams!"

"Neal has the BEST practice exams in the industry hands down!"

"Neal's practice tests were extremely useful for me as they were the closest to the real exam."

"Just passed my SA Pro exam. Have to admit that Neal’s Practice Tests are the most relevant to the real exam compared to others practice tests."

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy .

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to prepare for their AWS exams.

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED SOLUTIONS ARCHITECT PROFESSIONAL CERTIFICATION

The AWS Certified Solutions Architect Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS Solutions Architects are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified Solutions Architect Professional exam aims to test knowledge of the key services and tools used by Solutions Architects creating applications on AWS.

When you're ready to book your exam, you can do so on the AWS Training portal. Curious about the AWS Solutions Architect Professional certification cost? The SAP-C02 certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. It is our mission to ensure you pass your exam the first time and don't waste time or money. After going through the entire course and testing your knowledge with the AWS Solutions Architect Professional practice exams, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified Solutions Architect Professional exam who want to pass with confidence

Candidates preparing for the AWS Certified Solutions Architect Professional exam who want to pass their exam with confidence

Students who want to test their Cloud skills and assess their AWS exam readiness

Students who have completed the AWS Certified Solutions Architect Professional video course from Neal Davis and are looking for some final test prep

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

IT Professionals who want to enter any AWS technical Job interview with confidence

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

It is recommended that students have successfully passed the AWS Certified Solutions Architect Associate or have equivalent experience

Before assessing your exam readiness, we highly recommend our students to complete the AWS Certified Solutions Architect Professional Video Course by Neal Davis. These instructor-led video lectures from Digital Cloud Training build the solid knowledge foundation preparing students for the final step of their AWS certification journey

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 5: AWS Certified Solutions Architect Professional

AWS Certified Solutions Architect Professional - Results

Back to result overview
Attempt 2

All domains

All domains

AWS Migration & Transfer

AWS Compute

AWS Storage

AWS Database

AWS Management & Governance

AWS Networking & Content Delivery

AWS Developer Tools

AWS Security, Identity, & Compliance

AWS Analytics

35 all

0 correct

0 incorrect

35 skipped

0 marked

Collapse all questions

Question 1Skipped

An online shopping portal is running in eu-west-1 region. One of the application components uses AWS Lambda functions and stores inventory data in an Amazon Aurora database. Deployment of the Lambda functions is performed using a deployment package. The company has configured automated backups for Aurora.

The company wants to move the application to another AWS account within the same AWS organization. The application processes critical data and downtime must be minimized or avoided if possible.

Which solution will meet the requirements for moving this application from the source account to the target account?

Download the Lambda function package from the source account and use it to replicate the Lambda functions into the target account. Share an automated Aurora DB cluster snapshot with the target account.

Correct answer

Download the Lambda function package from the source account. Use the deployment package and create new Lambda functions in the target account. Share the Aurora DB cluster with the target account by using AWS Resource Access Manager (AWS RAM). Grant the Target account permission to clone the Aurora DB cluster.

Share the Lambda functions and the Aurora DB cluster with the target account using AWS Resource Access Manager (AWS RAM). Grant the target account permission to clone the Aurora DB cluster.

Use AWS Resource Access Manager (AWS RAM) to share the Lambda functions with the Target account. Share the automated Aurora DB cluster snapshot with the target account.

Overall explanation

By using AWS Resource Access Manager (AWS RAM) with Amazon Aurora, you can share Aurora DB clusters and clones that belong to your AWS account with another AWS account or organization. Such cross-account cloning is much faster than creating and restoring a database snapshot. You can create a clone of one of your Aurora DB clusters and share the clone. Or you can share your Aurora DB cluster with another AWS account and let the account holder create the clone. The approach that you choose depends on your use case.

CORRECT: "Download the Lambda function package from the source account. Use the deployment package and create new Lambda functions in the target account. Share the Aurora DB cluster with the target account by using AWS Resource Access Manager (AWS RAM). Grant the Target account permission to clone the Aurora DB cluster" is the correct answer (as explained above.)

INCORRECT: "Download the Lambda function package from the source account and use it to replicate the Lambda functions into the target account. Share an automated Aurora DB cluster snapshot with the target account" is incorrect.

This is a partially correct option since after sharing the account, permissions also need to be transferred to the new account to be able to provide access.

INCORRECT: "Share the Lambda functions and the Aurora DB cluster with the target account using AWS Resource Access Manager (AWS RAM). Grant the target account permission to clone the Aurora DB cluster" is incorrect.

Even though Aurora can be shared, Lambda is not a sharable resource with AWS RAM, hence this option is incorrect.

INCORRECT: "Use AWS Resource Access Manager (AWS RAM) to share the Lambda functions with the Target account. Share the automated Aurora DB cluster snapshot with the target account" is incorrect.

This option is reverse of the correct solution. Lambda is not a sharable resource in RAM and Aurora is a perfect candidate for RAM in a cross-account share, hence this option is incorrect as well.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html

https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-aur

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 2Skipped

A company is planning to migrate a containerized application to Amazon ECS. The company wishes to reduce instance costs as much as possible whilst reducing the probability of service interruptions. How should a Solutions Architect configure the solution?

Use Amazon ECS with Application Auto Scaling and suspend dynamic scaling.

Use Amazon ECS Cluster Auto Scaling (CAS) and configure a warm-up time.

Use Amazon ECS Reserved instances and configure termination protection.

Correct answer

Use Amazon ECS Spot instances and configure Spot Instance Draining.

Overall explanation

Spot instances are the lowest cost option but can be terminated by AWS at any time if they need the capacity back or the maximum configured price is exceeded. This can lead to service interruptions as the underlying container instances are terminated.

Automated Spot Instance Draining will automatically place Spot instances in “DRAINING” state upon the receipt of two minute interruption notice. ECS tasks running on Spot instances will automatically be triggered for shutdown before the instance terminates and replacement tasks will be scheduled elsewhere on the cluster. No new ECS service tasks will be started on the instances once the termination process has begun.

ECS takes over the coordination of termination of tasks with the termination of the underlying EC2 instance using the inherent instance “DRAINING” functionality. The managed termination, scheduling of replacement tasks and graceful termination of the LB connections reduces the probability of service interruptions. This makes it easier for customers to use Spot instances as part of their ECS cluster.

CORRECT: "Use Amazon ECS Spot instances and configure Spot Instance Draining" is the correct answer.

INCORRECT: "Use Amazon ECS Cluster Auto Scaling (CAS) and configure a warm-up time" is incorrect. The warm-up time defines the number of seconds it takes for a newly launched instance to warm up and is not relevant here.

INCORRECT: "Use Amazon ECS Reserved instances and configure termination protection" is incorrect. Termination protection with RIs will provide cost savings and protection from service interruptions but it is not the lowest cost option.

INCORRECT: "Use Amazon ECS with Application Auto Scaling and suspend dynamic scaling" is incorrect. This answer does not provide a solution for lowering instance costs and suspension of dynamic scaling is going to prevent scale-in and scale-out events from occurring.

References:

https://aws.amazon.com/about-aws/whats-new/2019/09/amazon-ecs-supports-automated-draining-for-spot-instances-running-ecs-services/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

Domain

AWS Compute

Question 3Skipped

A fleet of EC2 instances generate a large quantity of data and store the data on an Amazon EFS file system. The EC2 instances also backup the data by uploading to an Amazon S3 bucket in another Region on a daily basis. Some S3 uploads have been failing and the storage costs have significantly increased.

The operations team has removed the failed uploads. How can a Solutions Architect configure the backup jobs to efficiently backup data to S3 while reducing storage costs?

Correct answer

Use multipart upload for the backup jobs. Create a lifecycle policy for the incomplete multipart uploads on the S3 bucket to prevent new failed uploads from accumulating.

Use S3 Transfer Acceleration for the backup jobs. Create a lifecycle policy for the incomplete multipart uploads on the S3 bucket to prevent new failed uploads from accumulating.

Use multipart upload for the backup jobs. Create a lifecycle policy that archives data to Amazon S3 Glacier on a daily basis.

Use S3 Transfer Acceleration for the backup jobs. Use the Multi-Object Delete operation to remove the old uploads on a daily basis.

Overall explanation

S3’s multipart upload feature accelerates the uploading of large objects by allowing you to split them up into logical parts that can be uploaded in parallel. If you initiate a multipart upload but never finish it, the in-progress upload occupies some storage space and will incur storage charges.

However, these uploads are not visible when you list the contents of a bucket. You can use a lifecycle rule to clean up incomplete multipart uploads which will reduce storage space.

The rule configuration can be seen in the image below:

CORRECT: "Use multipart upload for the backup jobs. Create a lifecycle policy for the incomplete multipart uploads on the S3 bucket to prevent new failed uploads from accumulating" is the correct answer.

INCORRECT: "Use S3 Transfer Acceleration for the backup jobs. Use the Multi-Object Delete operation to remove the old uploads on a daily basis" is incorrect. S3 transfer acceleration is for optimizing the speed of uploads, multipart upload is a better solution for running uploads of parts of objects in parallel. Using multi-object delete is not an automated process, it will be much better to use a lifecycle rule for efficiency.

INCORRECT: "Use multipart upload for the backup jobs. Create a lifecycle policy that archives data to Amazon S3 Glacier on a daily basis" is incorrect. The failed uploads should not be archived, they should be deleted.

INCORRECT: "Use S3 Transfer Acceleration for the backup jobs. Create a lifecycle policy for the incomplete multipart uploads on the S3 bucket to prevent new failed uploads from accumulating" is incorrect. As explained above for S3 transfer acceleration.

References:

https://aws.amazon.com/blogs/aws/s3-lifecycle-management-update-support-for-multipart-uploads-and-delete-markers/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

Domain

AWS Storage

Question 4Skipped

A company's serverless application, comprising several AWS Lambda functions and Amazon DynamoDB tables, is undergoing an upgrade to include interaction with an Amazon Neptune DB cluster. This cluster is distributed across two subnets within a VPC.

Identify two solutions that would enable the Lambda functions to access both the Neptune DB cluster and the DynamoDB tables (Select TWO.)

Deploy the Lambda functions outside the VPC and establish a VPC endpoint for the Neptune database, enabling the Lambda functions to connect to Neptune through this endpoint.

Correct selection

Create two new subnets in the Neptune VPC, specifically for hosting the Lambda functions. Implement a VPC endpoint for DynamoDB to facilitate direct access from these subnets.

Keep the Lambda functions outside the VPC but modify the security group of the Neptune DB cluster to allow access based on the Lambda functions' dynamic IP ranges.

Create two public subnets in the Neptune VPC, with traffic managed through an internet gateway. Position the Lambda functions in these public subnets.

Correct selection

Configure two private subnets in the Neptune VPC and route internet traffic via a NAT gateway. Deploy the Lambda functions in these private subnets.

Overall explanation

Placing Lambda functions in private subnets within the Neptune VPC and using a NAT gateway for managing internet traffic is a secure method to allow access to the Neptune DB cluster. This configuration ensures controlled internet access and efficient communication between the Lambda functions and the Neptune cluster.

Hosting Lambda functions in dedicated subnets within the Neptune VPC and creating a VPC endpoint for DynamoDB provides a secure and direct connection to DynamoDB. This setup allows the Lambda functions to efficiently access both the Neptune DB cluster and the DynamoDB tables within a controlled environment.

CORRECT: "Configure two private subnets in the Neptune VPC and route internet traffic via a NAT gateway. Deploy the Lambda functions in these private subnets" is a correct answer (as explained above.)

CORRECT: "Create two new subnets in the Neptune VPC, specifically for hosting the Lambda functions. Implement a VPC endpoint for DynamoDB to facilitate direct access from these subnets" is also a correct answer (as explained above.)

INCORRECT: "Deploy the Lambda functions outside the VPC and establish a VPC endpoint for the Neptune database, enabling the Lambda functions to connect to Neptune through this endpoint" is incorrect.

Hosting Lambda functions outside the VPC and using a VPC endpoint for Neptune can introduce latency and potential security concerns.

INCORRECT: "Create two public subnets in the Neptune VPC, with traffic managed through an internet gateway. Position the Lambda functions in these public subnets" is incorrect.

Utilizing public subnets for Lambda functions to access the Neptune DB cluster is generally not recommended due to potential security risks, as it exposes the functions to the public internet.

INCORRECT: "Keep the Lambda functions outside the VPC but modify the security group of the Neptune DB cluster to allow access based on the Lambda functions' dynamic IP ranges" is incorrect.

Modifying the Neptune DB cluster's security group to allow access from Lambda functions' dynamic IP ranges is not practical, as Lambda functions do not have static IP addresses. This approach would be complex and potentially insecure.

References:

https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html

https://docs.aws.amazon.com/neptune/latest/userguide/intro.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-lambda/

Domain

AWS Database

Question 5Skipped

A corporation is seeking to develop a disaster recovery (DR) plan for its web application, which is currently operational in a single AWS Region. This application utilizes a microservices architecture with services running on AWS Fargate within Amazon Elastic Container Service (ECS). The data layer is handled by an Amazon RDS for MySQL database, and DNS management is conducted through Amazon Route 53. An Amazon CloudWatch alarm is configured to trigger an Amazon EventBridge rule in the event of an application failure.

The task is to design a DR strategy that enables quick restoration of the application in a different AWS Region following a failure.

Which approach would best meet these requirements?

Create a new ECS cluster and service on Fargate in an alternate Region. Create an AWS Lambda function to snapshot the RDS database, replicate the snapshot to the new Region, start a new RDS instance from this snapshot, and reconfigure Route 53 to point to the new ECS cluster. Update the EventBridge rule to trigger this Lambda function.

Create an AWS Lambda function to automate the deployment of a backup ECS cluster and service in a second Region. This function should: initiate a backup of the RDS database, transfer this backup to the alternate Region, establish a new RDS instance from the backup, and update Route 53 to redirect traffic to the backup ECS cluster. Modify the EventBridge rule to activate this Lambda function.

Correct answer

Set up a standby ECS cluster and service on Fargate in a different Region. Create a cross-Region RDS read replica in this new Region. Design an AWS Lambda function to promote the read replica to a primary database and reconfigure Route 53 to reroute traffic to the standby ECS cluster. Adjust the EventBridge rule to include this Lambda function as a target.

Create a redundant ECS cluster and service on Fargate in another Region. Regularly back up the RDS database and store these backups in the secondary Region. Create an AWS Lambda function to initiate a new RDS instance from the latest backup and update Route 53 to direct traffic to the redundant ECS cluster when needed. Revise the EventBridge rule to call this Lambda function.

Overall explanation

This solution is efficient for minimizing recovery time in a disaster scenario. By having a standby ECS cluster and service in a different Region and a cross-Region RDS read replica, the application can quickly switch to the standby environment.

The AWS Lambda function plays a crucial role in automating the promotion of the read replica to a primary database and updating Route 53 to ensure traffic is directed to the standby cluster. This approach ensures a rapid transition with minimal downtime.

CORRECT: "Set up a standby ECS cluster and service on Fargate in a different Region. Create a cross-Region RDS read replica in this new Region. Design an AWS Lambda function to promote the read replica to a primary database and reconfigure Route 53 to reroute traffic to the standby ECS cluster. Adjust the EventBridge rule to include this Lambda function as a target" is the correct answer (as explained above.)

INCORRECT: "Create a new ECS cluster and service on Fargate in an alternate Region. Create an AWS Lambda function to snapshot the RDS database, replicate the snapshot to the new Region, start a new RDS instance from this snapshot, and reconfigure Route 53 to point to the new ECS cluster. Update the EventBridge rule to trigger this Lambda function" is incorrect.

While creating a new ECS cluster and using a Lambda function to handle snapshots and Route 53 updates is a viable strategy, it may not be as efficient as using a read replica, especially in terms of data synchronization and recovery time.

INCORRECT: "Create an AWS Lambda function to automate the deployment of a backup ECS cluster and service in a second Region. This function should: initiate a backup of the RDS database, transfer this backup to the alternate Region, establish a new RDS instance from the backup, and update Route 53 to redirect traffic to the backup ECS cluster. Modify the EventBridge rule to activate this Lambda function" is incorrect.

Automating the deployment of a backup ECS cluster through a Lambda function is a good approach, but the process of initiating a backup and establishing a new RDS instance from it could be more time-consuming compared to using a read replica.

INCORRECT: "Create a redundant ECS cluster and service on Fargate in another Region. Regularly back up the RDS database and store these backups in the secondary Region. Create an AWS Lambda function to initiate a new RDS instance from the latest backup and update Route 53 to direct traffic to the redundant ECS cluster when needed. Revise the EventBridge rule to call this Lambda function" is incorrect.

Establishing a redundant ECS cluster and storing regular RDS backups in another Region is a valid strategy, but it might lead to longer recovery times due to the need to initiate a new RDS instance from backups during a disaster event.

References:

https://aws.amazon.com/disaster-recovery/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 6Skipped

An on-premises analytics database running on Oracle will be migrated to the cloud. The database runs on a single virtual machine (VM) and multiple client VMs running a Java-based web application that is used to perform SQL queries on the database. All virtual machines will be migrated to the cloud. The database uses 2 TB of storage and each client VM has a different configuration and saves stored procedures and query results in the local file system. There is a 10 Gbit AWS Direct Connect (DX) connection established and the application can be migrated over a scheduled 48-hour change window.

Which strategy will reduce the operational overhead on the database and have the LEAST impact on the operations staff after the migration?

Use AWS DMS to migrate the database to Amazon RedShift. Migrate the Java-based web application to an AWS Elastic Beanstalk environment behind an Application Load Balancer (ALB).

Use AWS SMS to replicate the database to AWS and create an Amazon EC2 instance. Migrate the Java-based web application to an AWS Elastic Beanstalk environment behind an Application Load Balancer (ALB).

Use AWS SMS to replicate the database to AWS and create an Amazon EC2 instance. Replicate the client VMs into AWS using AWS SMS. Place the EC2 instances behind an Application Load Balancer (ALB).

Correct answer

Use AWS DMS to migrate the database to Amazon RDS. Replicate the client VMs into AWS using AWS SMS. Create Route 53 A records for each client VM.

Overall explanation

There are two key requirements for this migration: reduce the operational overhead associated with the DB; minimize the impact on operations staff following the completion of the migration.

To reduce the operational overhead of the analytics database it can be migrated to an Amazon RDS Oracle DB. The migration can use the AWS Database Migration Service (DMS).

The client VMs these can be migrated using AWS Server Migration Service (DMS) which will replicate the existing operating systems into AWS. Amazon EC2 instances can then be created from the AMIs that SMS creates. This solution ensures that the stored procedures and query results in the file system is not lost and this will reduce the operational burden on staff after the migration.

The client instances should not be behind a ELB as they have different configurations therefore Route 53 A records can be created to connect directly to each instance.

CORRECT: "Use AWS DMS to migrate the database to Amazon RDS. Replicate the client VMs into AWS using AWS SMS. Create Route 53 A records for each client VM" is the correct answer.

INCORRECT: "Use AWS SMS to replicate the database to AWS and create an Amazon EC2 instance. Migrate the Java-based web application to an AWS Elastic Beanstalk environment behind an Application Load Balancer (ALB)" is incorrect. To lower operational overhead on the DB it can be migrated to RDS.

INCORRECT: "Use AWS DMS to migrate the database to Amazon RedShift. Migrate the Java-based web application to an AWS Elastic Beanstalk environment behind an Application Load Balancer (ALB)" is incorrect. Oracle Data Warehouses can be migrated to RedShift using DMS and the Schema Conversion Tool (SCT). The question does not explicitly state that this is a data warehouse nor that the SCT should be used.

INCORRECT: "Use AWS SMS to replicate the database to AWS and create an Amazon EC2 instance. Replicate the client VMs into AWS using AWS SMS. Place the EC2 instances behind an Application Load Balancer (ALB)" is incorrect. The client EC2 instances should not be behind an ALB as they each have different configurations.

References:

https://aws.amazon.com/dms/

https://aws.amazon.com/dms/schema-conversion-tool/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-migration-sap/

Domain

AWS Migration & Transfer

Question 7Skipped

A start-up company has been using bastion hosts to connect to EC2 instances which are based on the latest Amazon Linux 2 AMI. They use these bastion hosts to SSH into EC2 instances to view logs and other troubleshooting activities.

So far, they have configured a VPC with private and public subnets, and a NAT gateway. Also, they have a Site-to-Site VPN for connectivity with the on-premises environment and EC2 security groups with direct SSH access from the on-premises environment

To increase security control and comply with auditing requirements around access to instances, which strategy should a solutions architect use?

Correct answer

Create an IAM role with the AmazonSSMManagedInstanceCore managed policy attached. Attach the IAM role to all the EC2 instances. Remove all security group rules attached to the EC2 instances that allow inbound TCP on port 22. Have the engineers install the AWS Systems Manager Session Manager plugin for their devices and remotely access the instances by using the start-session API call from Systems Manager.

Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineer's devices. Install the Amazon CloudWatch agent on all EC2 instances and send operating system audit logs to CloudWatch Logs.

Install and configure EC2 Instance Connect on the fleet of EC2 instances. Remove all security group rules attached to EC2 instances that allow inbound TCP on port 22. Advise the engineers to remotely access the instances by using the EC2 Instance Connect CLI.

Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineer's devices. Enable AWS Config for EC2 security group resource changes. Enable AWS Firewall Manager and apply a security group policy that automatically remediates changes to rules.

Overall explanation

Session Manager is a fully managed AWS Systems Manager capability. With Session Manager, you can manage your Amazon Elastic Compute Cloud (Amazon EC2) instances, edge devices, and on-premises servers and virtual machines (VMs).

You can use either an interactive one-click browser-based shell or the AWS Command Line Interface (AWS CLI). Session Manager provides secure and auditable node management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys.

To use Session Manager you must have the client installed, and this is installed by default on instances launched form the Amazon Linux 2 AMI, and you must have permissions to communicate with AWS Systems Manager. The permissions should be assigned using an IAM role attached using an instance profile.

CORRECT: "Create an IAM role with the AmazonSSMManagedInstanceCore managed policy attached. Attach the IAM role to all the EC2 instances. Remove all security group rules attached to the EC2 instances that allow inbound TCP on port 22. Have the engineers install the AWS Systems Manager Session Manager plugin for their devices and remotely access the instances by using the start-session API call from Systems Manager" is the correct answer (as explained above.)

INCORRECT: "Install and configure EC2 Instance Connect on the fleet of EC2 instances. Remove all security group rules attached to EC2 instances that allow inbound TCP on port 22. Advise the engineers to remotely access the instances by using the EC2 Instance Connect CLI" is incorrect.

With this option, you’d need to install Instance connect on each EC2 instance and SSH client with client & key on each of the machines intending to connect with instance.

If number of terminals increase, this would mean maintaining a lot of keys which could become a security risk, hence this is not an appropriate option in above scenario.

INCORRECT: "Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineer's devices. Install the Amazon CloudWatch agent on all EC2 instances and send operating system audit logs to CloudWatch Logs" is incorrect.

Security groups should be generic in nature and not dependent on specific hosts. If engineers change within the team, security groups would require a change every time. Hence this is not a clean solution. Since audit logs requirement is not specified, this is not very relevant in this context.

INCORRECT: "Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineer's devices. Enable AWS Config for EC2 security group resource changes. Enable AWS Firewall Manager and apply a security group policy that automatically remediates changes to rules" is incorrect.

Like above option, this would create dependency on engineer’s device and hence pose a security risk. Firewall rules are same to all instances in this case and centralized firewall management is not the intended solution here.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html

https://github.com/aws/session-manager-plugin

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 8Skipped

A car rental company operates a serverless REST API, which includes an Amazon API Gateway with a Regional endpoint, AWS Lambda functions, and an Amazon Aurora MySQL Serverless DB cluster. This API, initially serving a mobile app, has been extended to partner mobile apps, leading to a substantial increase in requests and occasional database memory errors. Analysis shows that clients frequently make repeated HTTP GET requests for the same queries in short intervals, especially during business hours and around holidays.

To enhance the system's capacity to handle this increased load without significantly raising costs, what approach should the company adopt?

Adjust the configuration of the Aurora Serverless DB cluster to augment the maximum memory allocation.

Convert the API Gateway Regional endpoint to an edge-optimized endpoint and enable response caching at the production stage of the API Gateway.

Correct answer

Integrate an Amazon ElastiCache for Redis layer to cache database query results. Update the Lambda functions to retrieve data from this cache when available.

Implement rate limiting and burst control in the API Gateway production stage to manage the influx of incoming API calls.

Overall explanation

Implementing Amazon ElastiCache for Redis provides an effective caching mechanism for frequently accessed data. By caching the results of common database queries, the Lambda functions can serve repeated requests from the cache rather than querying the Aurora Serverless DB each time.

This approach significantly reduces the load on the database, mitigating memory errors caused by high request volumes. Additionally, using a cache can improve response times for the API clients and is a cost-effective way to scale the application to handle increased traffic without needing to proportionally scale the database.

CORRECT: "Integrate an Amazon ElastiCache for Redis layer to cache database query results. Update the Lambda functions to retrieve data from this cache when available" is the correct answer (as explained above.)

INCORRECT: "Convert the API Gateway Regional endpoint to an edge-optimized endpoint and enable response caching at the production stage of the API Gateway" is incorrect/

While enabling caching in API Gateway can reduce the number of requests reaching the backend, converting to an edge-optimized endpoint primarily benefits geographically distributed clients and may not address the core issue of database load.

INCORRECT: "Adjust the configuration of the Aurora Serverless DB cluster to augment the maximum memory allocation" is incorrect.

Increasing the maximum memory of the Aurora Serverless DB cluster can handle more requests but may not be the most cost-effective solution. It addresses the symptom (memory errors) rather than the cause (repeated queries).

INCORRECT: "Implement rate limiting and burst control in the API Gateway production stage to manage the influx of incoming API calls" is incorrect.

Throttling can prevent the system from being overwhelmed by too many requests but doesn't optimize the handling of legitimate, repeated queries. It might also degrade the user experience by limiting access to the API during peak times.

References:

https://aws.amazon.com/elasticache/redis/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-elasticache/

Domain

AWS Storage

Question 9Skipped

A Solutions Architect wants to make sure that only IAM users with appropriate permissions can access a new Amazon API Gateway endpoint. How can the Solutions Architect design the API Gateway access control to meet this requirement?

Create an AWS Lambda function as a custom authorizer and ask the API client to pass the key and secret when making the call, and then use Lambda to validate the key/secret pair against the IAM system.

Set the authorization to AWS_IAM for the API Gateway method. Create a permissions policy that grants lambda:InvokeFunction permission on the REST API resource and attach it to a group containing the IAM user accounts.

Create a client certificate for API Gateway. Distribute the certificate to the AWS users that need to access the endpoint. Enable the API caller to pass the client certificate when accessing the endpoint.

Correct answer

Set the authorization to AWS_IAM for the API Gateway method. Create a permissions policy that grants execute-api:Invoke permission on the REST API resource and attach it to a group containing the IAM user accounts.

Overall explanation

To allow an API caller to invoke the API or refresh its caching, you must create IAM policies that permit a specified API caller to invoke the API method for which the IAM user authentication is enabled. The API developer sets the method's authorizationType property to AWS_IAM to require that the caller submit the IAM user's access keys to be authenticated. Then, you attach the policy to an IAM user representing the API caller, to an IAM group containing the user, or to an IAM role assumed by the user.

In this IAM permissions policy statement, the IAM Resource element contains a list of deployed API methods identified by given HTTP verbs and API Gateway resource paths. The IAM Action element contains the required API Gateway API executing actions. These actions include execute-api:Invoke or execute-api:InvalidateCache, where execute-api designates the underlying API execution component of API Gateway.

CORRECT: "Set the authorization to AWS_IAM for the API Gateway method. Create a permissions policy that grants execute-api:Invoke permission on the REST API resource and attach it to a group containing the IAM user accounts" is the correct answer.

INCORRECT: "Create an AWS Lambda function as a custom authorizer and ask the API client to pass the key and secret when making the call, and then use Lambda to validate the key/secret pair against the IAM system" is incorrect. This solution does is not a valid method of integrating the REST API with IAM.

INCORRECT: "Set the authorization to AWS_IAM for the API Gateway method. Create a permissions policy that grants lambda:InvokeFunction permission on the REST API resource and attach it to a group containing the IAM user accounts" is incorrect. The permission that is being granted here is for invoking a Lambda function, not a REST API.

INCORRECT: "Create a client certificate for API Gateway. Distribute the certificate to the AWS users that need to access the endpoint. Enable the API caller to pass the client certificate when accessing the endpoint" is incorrect. Client certificates are a different way to authenticate, this is not using IAM user accounts.

References:

https://docs.aws.amazon.com/apigateway/latest/developerguide/permissions.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 10Skipped

An application runs on Amazon EC2 instances in a private subnet within an Amazon VPC. The application stores files in a specific Amazon S3 bucket. The files should not traverse the internet and only the application instances should be granted access to save files to the S3 bucket. A gateway endpoint has been created for Amazon S3 and connected to the Amazon VPC.

What additional steps should a Solutions Architect take to meet the stated requirements?

Attach an endpoint policy to the gateway endpoint that restricts access to S3 in the current Region. Attach a bucket policy to the S3 bucket that grants access to ec2.amazonaws.com service only.

Attach an endpoint policy to the gateway endpoint that restricts access to the specific S3 bucket. Attach a bucket policy to the S3 bucket that grants access only to the VPC endpoint.

Attach a bucket policy to the S3 bucket that grants access to the EC2 instances only using the aws:SourceIp condition. Update the VPC route table so only the application EC2 instances can access the VPC endpoint.

Correct answer

Attach an endpoint policy to the gateway endpoint that restricts access to the specific S3 bucket. Assign an IAM role to the EC2 instances and attach a policy to the S3 bucket that grants access only to this role.

Overall explanation

An endpoint policy can be attached to a gateway endpoint that will restrict access to the specific S3 bucket. This means the gateway endpoint can only be used to access that one particular bucket. To restrict access to the bucket to the EC2 instances only an IAM role can be assigned to the instances and then a bucket policy can be added to the bucket that restricts access only to the IAM role. This solution meets all requirements.

The diagram below depicts this configuration:

CORRECT: "Attach an endpoint policy to the gateway endpoint that restricts access to the specific S3 bucket. Assign an IAM role to the EC2 instances and attach a policy to the S3 bucket that grants access only to this role" is the correct answer.

INCORRECT: "Attach an endpoint policy to the gateway endpoint that restricts access to the specific S3 bucket. Attach a bucket policy to the S3 bucket that grants access only to the VPC endpoint" is incorrect. This does not restrict access to the specific EC2 instances running the application. This will allow any EC2 instances in the private subnet to access the S3 bucket (if they have S3 permissions).

INCORRECT: "Attach a bucket policy to the S3 bucket that grants access to the EC2 instances only using the aws:SourceIp condition. Update the VPC route table so only the application EC2 instances can access the VPC endpoint" is incorrect. The aws:SourceIp condition is used for restricting access based on public IP addresses, not private IP addresses.

INCORRECT: "Attach an endpoint policy to the gateway endpoint that restricts access to S3 in the current Region. Attach a bucket policy to the S3 bucket that grants access to ec2.amazonaws.com service only" is incorrect. This solution does not lock down the specific bucket or the specific application EC2 instances and fails to meet all requirements.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html#vpc-endpoint-policies

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Storage

Question 11Skipped

A manufacturing company collects data from IoT devices in JSON format. The data is collected, transformed, and stored in a data warehouse for analysis using an analytics tool that uses ODBC. The performance of the current solution suffers under high loads due to insufficient compute capacity and incoming data is often lost.

The application will be migrated to AWS. The solution must support the current analytics tool, resolve the compute constraints, and be cost-effective.

Which solution meets these requirements?

Re-architect the application. Load the data into Amazon S3. Use AWS Lambda to transform the data. Create an Amazon DynamoDB global table across two Regions to store the data and use Amazon Elasticsearch to query the data.

Re-architect the application. Load the data into Amazon S3. Use Amazon Kinesis Data Analytics to transform the data. Create an external schema in an AWS Glue Data Catalog. Use Amazon Redshift Spectrum to query the data.

Correct answer

Re-architect the application. Load the data into Amazon S3. Use AWS Glue to transform the data. Store the table schema in an AWS Glue Data Catalog. Use Amazon Athena to query the data.

Replatform the application. Use Amazon API Gateway for data ingestion. Use AWS Lambda to transform the JSON data. Create an Amazon Aurora PostgreSQL DB cluster with an Aurora Replica in another Availability Zone. Use Amazon QuickSight to generate reports and visualize data.

Overall explanation

There are multiple options that work here but we must select the most cost-effective and resilient solution that also resolves the performance constraints. Using a fully serverless architecture meets all of these goals.

The JSON data can be initially stored in Amazon S3 and then AWS Glue can be directed at the source bucket to run transformation on the data and store the results in another S3 bucket. The Glue Data Catalog is used to store metadata about the data in the S3 data lake.

Athena can be used to query the transformed data in the S3 bucket. The Amazon Athena ODBC driver can be used to connect to Athena from the existing analytics tool.

The architecture in the diagram below shows a similar solution using an AWS IoT Analytics channel. This also includes AWS Glue and Athena. Instead of using QuickSight to visualize data, the solution in the question scenario uses a third-party analytics tool connecting over ODBC.

CORRECT: "Re-architect the application. Load the data into Amazon S3. Use AWS Glue to transform the data. Store the table schema in an AWS Glue Data Catalog. Use Amazon Athena to query the data" is the correct answer.

INCORRECT: "Replatform the application. Use Amazon API Gateway for data ingestion. Use AWS Lambda to transform the JSON data. Create an Amazon Aurora PostgreSQL DB cluster with an Aurora Replica in another Availability Zone. Use Amazon QuickSight to generate reports and visualize data" is incorrect. This is a workable solution but is not as cost-effective as using a fully serverless architecture.

INCORRECT: "Re-architect the application. Load the data into Amazon S3. Use AWS Lambda to transform the data. Create an Amazon DynamoDB global table across two Regions to store the data and use Amazon Elasticsearch to query the data" is incorrect. This is another workable solution and you can connect to Elasticsearch using ODBC. However, the DynamoDB global table introduces additional cost and is unnecessary in this solution.

INCORRECT: "Re-architect the application. Load the data into Amazon S3. Use Amazon Kinesis Data Analytics to transform the data. Create an external schema in an AWS Glue Data Catalog. Use Amazon Redshift Spectrum to query the data" is incorrect. There is no mention of where the data would be output to, and this would not the most cost-effective solution.

References:

https://docs.aws.amazon.com/athena/latest/ug/connect-with-odbc.html

https://docs.aws.amazon.com/athena/latest/ug/data-sources-glue.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-analytics-sap/

Domain

AWS Management & Governance

Question 12Skipped

A web application is being deployed on Amazon EC2 instances and requires that users authenticate before they can access content. The solution needs to be configured so that it is highly available. Once authenticated, users should remain connected even if an underlying instance fails.

Which solution will meet these requirements?

Use AWS Global Accelerator to forward requests to the EC2 instances. Use Amazon DynamoDB to save the authenticated connection details.

Create an Auto Scaling group for the EC2 instances and use an Application Load Balancer to direct incoming requests. Use AWS Secrets Manager to save the authenticated connection details.

Create an Auto Scaling group for the EC2 instances and use an Application Load Balancer to direct incoming requests. Save the authenticated connection details on Amazon EBS volumes.

Correct answer

Create an Auto Scaling group for the EC2 instances and use an Application Load Balancer to direct incoming requests. Use Amazon DynamoDB to save the authenticated connection details.

Overall explanation

This solution can be easily solved by using a combination of Auto Scaling and load balancing to ensure high availability of the web application. To ensure users remain connected even if the instance they are on fails, the authenticated connection details can be stored in Amazon DynamoDB. This helps reduce the need for users to re-authenticate. DynamoDB is often used for session state data and ElastiCache is another service that can be used for this use case.

CORRECT: "Create an Auto Scaling group for the EC2 instances and use an Application Load Balancer to direct incoming requests. Use Amazon DynamoDB to save the authenticated connection details" is the correct answer.

INCORRECT: "Use AWS Global Accelerator to forward requests to the EC2 instances. Use Amazon DynamoDB to save the authenticated connection details" is incorrect. Global Accelerator is used for directing connections to different implementations of an application in different Regions. It is not suitable for the requirements in this scenario.

INCORRECT: "Create an Auto Scaling group for the EC2 instances and use an Application Load Balancer to direct incoming requests. Save the authenticated connection details on Amazon EBS volumes" is incorrect. EBS volumes are locally attached to EC2 instances and will be lost if the instance is terminated. A serverless service that is suitable for storing session state data should be used instead (e.g. DynamoDB or ElastiCache).

INCORRECT: "Create an Auto Scaling group for the EC2 instances and use an Application Load Balancer to direct incoming requests. Use AWS Secrets Manager to save the authenticated connection details" is incorrect. Secrets Manager is used for storing credentials that are used by applications but would not be used for storing session state data for users of the application.

References:

https://aws.amazon.com/dynamodb/features/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

Domain

AWS Compute

Question 13Skipped

An application runs across a fleet of Amazon EC2 instances in an Auto Scaling group. Application logs are collected from the EC2 instances using a cron job that is scheduled to run every 30 minutes. The cron job saves the log files to an Amazon S3 bucket. Failures and scaling events have caused some logs to be lost as the instances have been lost before the cron job collected the log files.

Which of the following options is the MOST reliable way of collecting and preserving the log files?

Correct answer

Use the Amazon CloudWatch Logs agent to stream log messages directly to CloudWatch Logs. Configure the batch_count parameter to 1.

Update the cron job to run every 5 minutes instead of every 30 minutes to reduce the possibility of log files being lost.

Use Amazon CloudWatch Events to trigger and AWS Lambda function that collects the log files using an SSH connection.

Use Amazon CloudWatch Events to trigger Amazon Systems Manager Session Manager to run a batch script that collects the log files.

Overall explanation

You can use the CloudWatch Logs agent to collect application and system logs form an EC2 instance and send them to CloudWatch Logs. Logs automatically flow from the instance to the log stream you create. The batch_count parameter specifies the max number of log events in a batch, up to 10000. Using a value of 1 will result in every log entry being immediately streamed to CloudWatch Logs.

This is the most reliable method of collecting the logs as by using a streaming solution the logs are immediately saved.

CORRECT: "Use the Amazon CloudWatch Logs agent to stream log messages directly to CloudWatch Logs. Configure the batch_count parameter to 1" is the correct answer.

INCORRECT: "Update the cron job to run every 5 minutes instead of every 30 minutes to reduce the possibility of log files being lost" is incorrect. This will still result in log entries being lost with up to 5 minutes of data.

INCORRECT: "Use Amazon CloudWatch Events to trigger Amazon Systems Manager Session Manager to run a batch script that collects the log files" is incorrect. Session Manager is used instead of SSH for connecting securely to EC2 and running commands. It is not well suited to this scenario for collecting log files automatically.

INCORRECT: "Use Amazon CloudWatch Events to trigger and AWS Lambda function that collects the log files using an SSH connection" is incorrect. You cannot configure CloudWatch Events to trigger for application log entries so this would not work.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Management & Governance

Question 14Skipped

A start-up company has created a new serverless application which includes an AWS Lambda function which sits behind an Amazon API gateway and an Amazon CloudFront CDN. The development team is currently using AWS CLI scripts to update the versions of Lambda functions. In case an error is detected, a different CLI script is used to roll back the version to the previous stable one.

A solutions architect needs to optimize this process and reduce the time taken to switch versions and detect the error in Lambda functions.

How can this be accomplished?

Create an AWS CloudFormation stack with API Gateway endpoint resource that references the new Lambda version. Change the CloudFront origin to the new API Gateway endpoint in case of success, else rollback to the previous version.

Correct answer

Use AWS SAM and built-in AWS CodeDeploy to deploy the new Lambda version, gradually shift traffic to the new version, and use pre-traffic and post-traffic test functions to verify code. Rollback in case Amazon CloudWatch alarms is triggered.

Merge the AWS CLI scripts into a single script that deploys the new Lambda version. Execute these scripts when deployment is completed. If errors are detected, revert to the previous Lambda version.

Add the AWS CloudFront distribution and API Gateway in the parent stack and AWS Lambda in a child stack. Within these nested stacks, when changes are to be introduced to AWS Lambda create an AWS CloudFormation change set and deploy. Revert the AWS CloudFormation change set to the previous version in case of failure.

Overall explanation

Explanation:

AWS CodeDeploy leverages Lambda’s traffic shifting capabilities to automate the gradual rollout of new function versions. It can also help you use deployment best practices, such as testing a new change on a small portion of traffic before deploying it to all customers. For example, CodeDeploy lets you automate pre-deployment tests that a function must pass before it begins taking traffic. You can also set alarms that automatically trigger rollbacks in the event of errors.

CORRECT: "Use AWS SAM and built-in AWS CodeDeploy to deploy the new Lambda version, gradually shift traffic to the new version, and use pre-traffic and post-traffic test functions to verify code. Rollback in case Amazon CloudWatch alarms is triggered" is the correct answer (as explained above.)

INCORRECT: "Add the AWS CloudFront distribution and API Gateway in the parent stack and AWS Lambda in a child stack. Within these nested stacks, when changes are to be introduced to AWS Lambda create an AWS CloudFormation change set and deploy. Revert the AWS CloudFormation change set to the previous version in case of failure" is incorrect.

Change sets don’t indicate whether AWS CloudFormation will successfully update a stack. It needs manual intervention to check the error and provide a resolution hence this is not a correct option.

INCORRECT: "Merge the AWS CLI scripts into a single script that deploys the new Lambda version. Execute these scripts when deployment is completed. If errors are detected, revert to the previous Lambda version" is incorrect.

Even though CLI provides finer grain control to the AWS resources, this is more suitable for a development environment since debugging is tougher and needs manual effort. Therefore, the CLI does not reduce the amount of effort and is not a preferable option.

INCORRECT: "Create an AWS CloudFormation stack with API Gateway endpoint resource that references the new Lambda version. Change the CloudFront origin to the new API Gateway endpoint in case of success, else rollback to the previous version" is incorrect.

While this is feasible, to detect the error, the CloudFormation output needs to be checked, lambda logs need to be checked and then CloudFront origin needs to be changed. Since the question is asking about reducing the time, this is also not a correct option.

References:

https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/automating-updates-to-serverless-apps.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 15Skipped

A secure web application runs in an Amazon VPC that has a public subnet and a private subnet. An Application Load Balancer is deployed into the public subnet. Each subnet has a separate Network ACL. The public subnet CIDR range is 10.1.0.0/24 and the private subnet CIDR range is 10.1.1.0/24. The web application is deployed on Amazon EC2 instances in the private subnet. Which combination of rules should be defined on the private subnet’s Network ACL to allow access from internet-based clients?

(Select TWO.)

An outbound rule for port 443 to destination 0.0.0.0/0.

Correct selection

An outbound rule for ports 1024 through 65535 to destination 10.1.0.0/24.

Correct selection

An inbound rule for port 443 from source 10.1.0.0/24.

An inbound rule for port 443 from source 0.0.0.0/0.

An outbound rule for port 443 to destination 10.1.0.0/24.

Overall explanation

Network ACLs are stateless firewalls. This means you must define rules for the inbound and outbound connections. In this case the source address of packets coming towards the instances will be the IP addresses of the ALB nodes in 10.1.0.0/24. An inbound rule allowing 443 from this source network should be created.

The outbound connection will be made to the source port of the ALB node which is a dynamically defined high number port between 1024 and 65535. Therefore, an outbound rule must be created that allows this port range to destination 10.1.0.0/24.

CORRECT: "An inbound rule for port 443 from source 10.1.0.0/24." is a correct answer.

CORRECT: "An outbound rule for ports 1024 through 65535 to destination 10.1.0.0/24." is also a correct answer.

INCORRECT: "An inbound rule for port 443 from source 0.0.0.0/0." is incorrect. This would allow any source IP range but should be locked down to the ALB nodes in 10.1.0.0/24

INCORRECT: "An outbound rule for port 443 to destination 0.0.0.0/0." is incorrect. The outbound connection will not have a destination port of 443, the destination port will be a high numbered port between 1024 and 65535.

INCORRECT: "An outbound rule for port 443 to destination 10.1.0.0/24." is incorrect. The outbound connection will not have a destination port of 443, the destination port will be a high numbered port between 1024 and 65535.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 16Skipped

A development team created a service that uses an AWS Lambda function to store information in an Amazon RDS Database. The database credentials are stored in clear text in the Lambda function code. A Solutions Architect is advising the development team on how to better secure the service. Which of the following should the Solutions Architect recommend? (Select TWO.)

Create a Lambda function to rotate the credentials every hour by deploying a new Lambda version with the updated credentials.

Configure Lambda to use the stored database credentials in AWS KMS and enabled automatic key rotation.

Correct selection

Configure Lambda to use the stored database credentials in AWS Secrets Manager and enable automatic rotation.

Correct selection

Create encrypted database credentials in AWS Secrets Manager for the Amazon RDS database.

Store the Amazon RDS database credentials in AWS KMS using imported key material.

Overall explanation

AWS Secrets Manager can be used to rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. You can configure Secrets Manager to rotate secrets automatically, which can help you meet your security and compliance needs. Secrets Manager offers built-in integrations for MySQL, PostgreSQL, and Amazon Aurora on Amazon RDS, and can rotate credentials for these databases natively.

The steps to configure Secrets Manger for this scenario are to first create the database credentials in Secrets Manager (without enabling rotation), and then to update the Lambda function to use Secrets Manager to obtain the DB credentials. At that point secret rotation can be enabled.

The image below shows the screen in Secrets Manager where you can select an existing database for which you will store credentials:

CORRECT: "Create encrypted database credentials in AWS Secrets Manager for the Amazon RDS database" is a correct answer.

CORRECT: "Configure Lambda to use the stored database credentials in AWS Secrets Manager and enable automatic rotation" is also a correct answer.

INCORRECT: "Create a Lambda function to rotate the credentials every hour by deploying a new Lambda version with the updated credentials" is incorrect. The credentials can be rotated in Secrets Manager and a new Lambda function is not required.

INCORRECT: "Configure Lambda to use the stored database credentials in AWS KMS and enabled automatic key rotation" is incorrect. KMS is used for storing encryption keys, not credentials.

INCORRECT: "Store the Amazon RDS database credentials in AWS KMS using imported key material" is incorrect. You cannot import database credentials into KMS, you can only import key material for a CMK.

References:

https://aws.amazon.com/blogs/security/rotate-amazon-rds-database-credentials-automatically-with-aws-secrets-manager/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Security, Identity, & Compliance

Question 17Skipped

An eCommerce website consists of a two-tier architecture. Amazon EC2 instances in an Auto Scaling group are used for the web server layer behind an Application Load Balancer (ALB). The web servers run a PHP application on Apache Tomcat. The database layer runs on an Aurora MySQL database instance.

Recently, a large sales event caused some errors to occur for customers when placing orders on the website. The operations team collected logs from the web servers and reviewed Aurora DB cluster performance metrics. Several web servers were terminated by the ASG before the logs could be collected and the Aurora metrics were not sufficient for query performance analysis.

Which combination of steps should a Solutions Architect take to improve application performance visibility during peak traffic events? (Select THREE.)

Correct selection

Install and configure an Amazon CloudWatch Logs agent on the EC2 instances to send the Apache logs to CloudWatch Logs.

Configure the Aurora MySQL DB cluster to generate error logs by setting parameters in the parameter group.

Configure an Amazon EventBridge rule that triggers Lambda upon Aurora error events and saves logs to Amazon S3 for analysis with Amazon Athena.

Correct selection

Configure the Aurora MySQL DB cluster to generate slow query logs by setting parameters in the parameter group.

Configure AWS CloudTrail to collect API activity from Amazon EC2 and Aurora and analyze with Amazon Athena.

Correct selection

Implement the AWS X-Ray SDK to trace incoming HTTP requests on the EC2 instances and implement tracing of SQL queries with the X-Ray SDK for PHP.

Overall explanation

For Amazon Aurora you can monitor the MySQL error log, slow query log, and the general log. The MySQL error log is generated by default; you can generate the slow query and general logs by setting parameters in your DB parameter group. This data will help troubleshoot any issues with the Aurora database layer.

AWS X-Ray is a service that collects data about requests that your application serves, and provides tools you can use to view, filter, and gain insights into that data to identify issues and opportunities for optimization. You can use the AWS SDK to develop programs that use the X-Ray API. In this case the application runs on PHP so the X-Ray SDK for PHP should be used.

Some instances were terminated by the ASG before the logs could be collected. To prevent this issue from reoccurring, the CloudWatch Logs agent can be installed on instances. The agent streams logs straight to CloudWatch logs at regular intervals (configurable) so the logs will not be lost next time.

CORRECT: "Configure the Aurora MySQL DB cluster to generate slow query logs by setting parameters in the parameter group" is a correct answer.

CORRECT: "Implement the AWS X-Ray SDK to trace incoming HTTP requests on the EC2 instances and implement tracing of SQL queries with the X-Ray SDK for PHP" is also a correct answer.

CORRECT: "Install and configure an Amazon CloudWatch Logs agent on the EC2 instances to send the Apache logs to CloudWatch Logs" is also a correct answer.

INCORRECT: "Configure the Aurora MySQL DB cluster to generate error logs by setting parameters in the parameter group" is incorrect. Error logs are generated by default; however the slow query logs can be added by configuring parameters.

INCORRECT: "Configure AWS CloudTrail to collect API activity from Amazon EC2 and Aurora and analyze with Amazon Athena" is incorrect. API activity tells us who did what API action and when. In this case we are attempting to troubleshoot performance issues so auditing data is not as useful as performance metrics, tracing, and logs.

INCORRECT: "Configure an Amazon EventBridge rule that triggers Lambda upon Aurora error events and saves logs to Amazon S3 for analysis with Amazon Athena" is incorrect. EventBridge is not used for triggering on error events occurring in Aurora.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.Concepts.MySQL.html

https://docs.aws.amazon.com/xray/latest/devguide/xray-api.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_GettingStarted.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-application-integration-sap/

Domain

AWS Database

Question 18Skipped

A serverless application uses an AWS Lambda function behind and Amazon API Gateway REST API. During busy periods thousands of simultaneous invocations are required and requests fail multiple times before succeeding. The operations team has checked for AWS Lambda errors and did not find any. A Solutions Architect must investigate the root cause of the issue. What is the most likely cause of this problem?

Correct answer

The throttle limit on the REST API is configured too low. During busy periods some requests are being throttled and are not reaching the Lambda function.

The API is using the non-proxy integration with Lambda when it should be using proxy integration.

The Lambda is configured with too little memory causing the function to fail at peak load.

The Lambda function is set to use synchronous invocation and the REST API is calling the function using asynchronous invocation.

Overall explanation

Throttling can be configured for API Gateway at the stage or usage plan level. Amazon API Gateway provides two basic types of throttling-related settings:

• Server-side throttling limits are applied across all clients. These limit settings exist to prevent your API—and your account—from being overwhelmed by too many requests.

• Per-client throttling limits are applied to clients that use API keys associated with your usage policy as client identifier.

In this case it is likely that the server-side throttling limits are configured to a value that is too low for the periods of peak usage. This is causing requests to fail repeatedly before they finally make it through to the Lambda function.

This is the most likely cause of the issue as it is clear the requests are not reaching Lambda or there would be errors logged by the function.

CORRECT: "The throttle limit on the REST API is configured too low. During busy periods some requests are being throttled and are not reaching the Lambda function" is the correct answer.

INCORRECT: "The Lambda is configured with too little memory causing the function to fail at peak load" is incorrect. If this was the case we would see errors being logged by Lambda but there aren’t any.

INCORRECT: "The Lambda function is set to use synchronous invocation and the REST API is calling the function using asynchronous invocation" is incorrect. API Gateway can be configured to invoke a Lambda function both synchronously and asynchronously.

INCORRECT: "The API is using the non-proxy integration with Lambda when it should be using proxy integration" is incorrect. API Gateway can be configured to connect to Lambda using both proxy and non-proxy integrations.

References:

https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

Domain

AWS Networking & Content Delivery

Question 19Skipped

A company runs a Java application on Amazon EC2 instances. The DevOps team uses a combination of Amazon CloudFormation and AWS OpsWorks to update the infrastructure and application stacks respectively. During recent updates the DevOps team reported service disruption issues that affected the Java application running on the Amazon EC2 instances.

Which solution will increase the reliability of application updates?

Implement CloudFormation change sets.

Implement the canary release strategy.

Implement CloudFormation Stack sets.

Correct answer

Implement a blue/green deployment strategy.

Overall explanation

AWS OpsWorks is performing the updates to the application. There is no report of the infrastructure stack having any errors and therefore CloudFormation is not relevant.

AWS OpsWorks supports a blue-green deployment strategy. It does not support a canary deployment strategy.

A blue-green deployment strategy is a common way to efficiently use separate stacks to deploy an application update to production.

• The blue environment is the production stack, which hosts the current application.

• The green environment is the staging stack, which hosts the updated application.

When you are ready to deploy the updated app to production, you switch user traffic from the blue stack to the green stack, which becomes the new production stack. You then retire the old blue stack.

This deployment strategy offers the ability to perform testing on the green environment before fully cutting over and this can improve reliability for updates.

CORRECT: "Implement a blue/green deployment strategy" is the correct answer.

INCORRECT: "Implement the canary release strategy" is incorrect. OpsWorks does not support a canary release methodology.

INCORRECT: "Implement CloudFormation change sets" is incorrect. CloudFormation is used to deploy the underlying infrastructure stack (e.g. Amazon EC2 and related infrastructure), OpsWorks is being used to deploy the application updates.

INCORRECT: "Implement CloudFormation Stack sets" is incorrect. As above.

References:

https://docs.aws.amazon.com/opsworks/latest/userguide/best-deploy.html#best-deploy-environments-blue-green

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Compute

Question 20Skipped

A company uses an AWS account with resources deployed in multiple Regions globally. Operations teams deploy and manage resources within each Region. Some Region-specific service quotas have been reached causing an inability for the local operations teams to deploy resources. A centralized cloud team is responsible for monitoring and updating service quotas. The cloud team needs to create an automated and operationally efficient solution to proactively monitor service quotas. Monitoring should occur every 15 minutes and send alerts when a team exceeds 80% utilization.

Which solution will meet these requirements?

Create an Amazon EventBridge rule that triggers an AWS Lambda function to use AWS Trusted Advisor to retrieve the most current utilization and service limit data. If the current utilization is above 80%, use AWS Budgets to send an alert to the cloud team.

Create a scheduled AWS Config rule to trigger an AWS Lambda function to call the ListServiceQuotas API. If any service utilization is above 80%, publish a message to an Amazon SNS topic to alert the cloud team.

Create a scheduled AWS Config rule to trigger an AWS Lambda function to call the GetServiceQuota API. If any service utilization is above 80%, publish a message to an Amazon SNS topic to alert the cloud team.

Correct answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to use AWS Trusted Advisor to retrieve the most current utilization and service limit data. If the current utilization is above 80%, publish a message to an Amazon SNS topic to alert the cloud team.

Overall explanation

Amazon EventBridge (formerly Amazon CloudWatch Events) can be used to run a function on a schedule. The function can retrieve the most current utilization and service limit data. The function can then trigger an SNS topic if the utilization is above 80%. This solution meets all requirements.

CORRECT: "Create an Amazon EventBridge rule that triggers an AWS Lambda function to use AWS Trusted Advisor to retrieve the most current utilization and service limit data. If the current utilization is above 80%, publish a message to an Amazon SNS topic to alert the cloud team" is the correct answer.

INCORRECT: "Create an Amazon EventBridge rule that triggers an AWS Lambda function to use AWS Trusted Advisor to retrieve the most current utilization and service limit data. If the current utilization is above 80%, use AWS Budgets to send an alert to the cloud team" is incorrect.

AWS Budgets is used for tracking and alerting on spend on your AWS account, it is not a messaging service for alerting.

INCORRECT: "Create a scheduled AWS Config rule to trigger an AWS Lambda function to call the GetServiceQuota API. If any service utilization is above 80%, publish a message to an Amazon SNS topic to alert the cloud team" is incorrect.

The GetServiceQuota API will simply list the current quota, it does not return data showing how much of that quota has been utilized.

INCORRECT: "Create a scheduled AWS Config rule to trigger an AWS Lambda function to call the ListServiceQuotas API. If any service utilization is above 80%, publish a message to an Amazon SNS topic to alert the cloud team" is incorrect.

The ListServiceQuotas API lists the service quota applied to a specific service. It also does not return data showing how much of that quota has been utilized.

References:

https://docs.aws.amazon.com/awssupport/latest/user/trustedadvisor.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Management & Governance

Question 21Skipped

A company runs a high performance computing (HPC) application in an on-premises data center. The solution consists of a 10-node cluster running Linux with high-speed inter-node connectivity. The company is planning to migrate the application to the AWS Cloud. A Solutions Architect needs to design the solution architecture on AWS to ensure optimum performance for the HPC cluster.

Which combination of steps will meet these requirements? (Select TWO.)

Deploy Amazon EC2 instances in an Auto Scaling group.

Correct selection

Use Amazon EC2 instances that support Elastic Fabric Adapter (EFA).

Deploy instances across multiple Availability Zones.

Use Amazon EC2 instances that support burstable performance.

Correct selection

Deploy Amazon EC2 instances in a placement group.

Overall explanation

High performance computing applications require that the nodes have very high-bandwidth, low-latency connections between the nodes in the cluster. AWS recommend that the instances are placed in a placement group.

A cluster placement group should be used as it packs instances close together inside an Availability Zone. This strategy enables workloads to achieve the low-latency network performance necessary for tightly-coupled node-to-node communication that is typical of HPC applications.

Elastic Fabric Adapter (EFA) is a network interface for Amazon EC2 instances that enables customers to run applications requiring high levels of inter-node communications at scale on AWS. Its custom-built operating system (OS) bypass hardware interface enhances the performance of inter-instance communications, which is critical to scaling these applications.

CORRECT: "Deploy Amazon EC2 instances in a placement group" is a correct answer.

CORRECT: "Use Amazon EC2 instances that support Elastic Fabric Adapter (EFA)" is also a correct answer.

INCORRECT: "Deploy instances across multiple Availability Zones" is incorrect. To ensure the best inter-node connectivity the instances should be deployed in a single AZ.

INCORRECT: "Use Amazon EC2 instances that support burstable performance" is incorrect. This is not a recommended solution for optimum performance of HPC applications.

INCORRECT: "Deploy Amazon EC2 instances in an Auto Scaling group" is incorrect. This does not enable better performance.

References:

https://aws.amazon.com/hpc/efa/

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

https://aws.amazon.com/hpc/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

Domain

AWS Compute

Question 22Skipped

A media company runs an application that uses a static website configured in an Amazon S3 bucket and an Amazon CloudFront distribution. The website calls an Amazon API Gateway REST API, and an AWS Lambda function backs each API method.

The company wants to generate a CSV report every 2 weeks that records the following for each Lambda function:

· Recommended configured memory.

· Recommended cost.

· Price difference between current configurations and the recommendations.

Which solution will meet these requirements with the LEAST development time?

Correct answer

Use AWS Compute Optimizer. Call the “ExportLambdaFunctionRecommendations” operation for the Lambda functions. Export the .csv file to an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks.

Create an additional Lambda function that extracts metrics data from Amazon CloudWatch Logs for each application Lambda function. Collate the data into tabular format. Store the data as a .csv file in an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks.

Use AWS Compute Optimizer. Set up enhanced infrastructure metrics. Within the Compute Optimizer console, schedule a job to export the Lambda recommendations to a .csv file. Store the file in an S3 bucket every 2 weeks.

Purchase the AWS Business Support plan for the production account. Opt into AWS Compute Optimizer for AWS Trusted Advisor checks. In the Trusted Advisor console, schedule a job to export the cost optimization checks to a .csv file. Store the file in an S3 bucket every 2 weeks.

Overall explanation

Explanation:

You can export your recommendations to record them over time and share the data with others. Recommendations are exported in a comma-separated values (.csv) file, and its metadata in a JavaScript Object Notation (.json) file, to an existing Amazon Simple Storage Service (Amazon S3) bucket that you specify.

Recommendations are exported in a comma-separated values (.csv) file, and its metadata in a JavaScript Object Notation (JSON) (.json) file, to an existing Amazon Simple Storage Service (Amazon S3) bucket that you specify. For more information, see Exporting Recommendations in the Compute Optimizer User Guide.

CORRECT: "Use AWS Compute Optimizer. Call the “ExportLambdaFunctionRecommendations” operation for the Lambda functions. Export the .csv file to an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks" is the correct answer (as explained above.)

INCORRECT: "Create an additional Lambda function that extracts metrics data from Amazon CloudWatch Logs for each application Lambda function. Collate the data into tabular format. Store the data as a .csv file in an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks" is incorrect.

This option involves a lot of manual steps and additional effort for building the Lambda function, this would also add the cost of function invocation and so is not a suitable option.

INCORRECT: "Use AWS Compute Optimizer. Set up enhanced infrastructure metrics. Within the Compute Optimizer console, schedule a job to export the Lambda recommendations to a .csv file. Store the file in an S3 bucket every 2 weeks" is incorrect.

The question ask specifically about the Lambda function's recommended configured memory, recommended cost, and the price difference between current configurations and the recommendations. Therefore, this is not the most suitable solution.

INCORRECT: "Purchase the AWS Business Support plan for the production account. Opt into AWS Compute Optimizer for AWS Trusted Advisor checks. In the Trusted Advisor console, schedule a job to export the cost optimization checks to a .csv file. Store the file in an S3 bucket every 2 weeks" is incorrect.

AWS Compute Optimizer provides many inbuilt checks, and it is not necessary to have an AWS Business support plan. Also implementing the steps mentioned in this option would involve lot of steps initially and trusted advisor wouldn’t be able to deliver exact data in the format required.

References:

https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_ExportLambdaFunctionRecommendations.html

https://docs.aws.amazon.com/compute-optimizer/latest/ug/exporting-recommendations.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-lambda/

Domain

AWS Compute

Question 23Skipped

A financial company stores personally identifiable information (PII) in an Amazon S3 bucket which currently does not have versioning enabled. The current configuration has server-side encryption with S3 managed encryption keys (SSE-S3) enabled to encrypt the objects. According to a new requirement, all current and future objects in the S3 bucket must be encrypted by keys that the company's security team manages.

Which solution will meet these requirements?

Change the default encryption to SSE-S3 with a customer managed key. Use the AWS CLI to re-upload all objects in the S3 bucket. Set an S3 bucket policy to deny unencrypted PutObject requests.

In the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Set an S3 bucket policy to automatically encrypt objects on GetObject and PutObject requests.

Change the default encryption to AES-256 with a customer managed key. Attach a policy to deny unencrypted PutObject requests to any entities that access the S3 bucket. Use the AWS CLI to re-upload all objects in the S3 bucket.

Correct answer

Change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS) in S3 bucket. Set an S3 bucket policy to deny unencrypted PutObject requests. Use the AWS CLI to re-upload all objects in the S3 bucket.

Overall explanation

You can configure your bucket to use an S3 Bucket Key for SSE-KMS on new objects by using the Amazon S3 console, REST API, Amazon SDK, Amazon CLI, or Amazon CloudFormation. If you want to enable or disable an S3 Bucket Key for existing objects, you can use a COPY operation.

Switching to AWS KMS from AWS SSE-S3 can provide some additional benefits, including protection from policies that may be overly permissive. For example, adding a bucket policy allowing overly broad access to the data instead of individual users or roles. By implementing encryption using KMS keys, the accessor of the resources would need Amazon S3 policy access and access to a KMS key to decrypt data.

The KMS key is managed by the company. To encrypt existing objects with this key they would need to be uploaded again and this operation can be performed using the AWS CLI.

CORRECT: "Change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS) in S3 bucket. Set an S3 bucket policy to deny unencrypted PutObject requests. Use the AWS CLI to re-upload all objects in the S3 bucket" is the correct answer (as explained above.)

INCORRECT: "In the S3 bucket properties, change the default encryption to SSE-S3 with a customer managed key. Use the AWS CLI to re-upload all objects in the S3 bucket. Set an S3 bucket policy to deny unencrypted PutObject requests" is incorrect.

You cannot manage your own encryption key with SSE-S3.

INCORRECT: "Change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS) in S3 bucket. Set an S3 bucket policy to automatically encrypt objects on GetObject and PutObject requests" is incorrect.

You cannot encrypt using GetObject requests as this is downloading objects and they are first decrypted. The bucket policy should be setup to enforce encryption for PutObject requests only.

INCORRECT: "Change the default encryption to AES-256 with a customer managed key. Attach a policy to deny unencrypted PutObject requests to any entities that access the S3 bucket. Use the AWS CLI to re-upload all objects in the S3 bucket" is incorrect.

Server-Side Encryption in S3 is always AES256, whether you are using SSE-S3 or SSE-KMS.

When changing the encryption type, we choose among AWS/ S3 managed or customer managed but the algorithm remains the same hence this is also incorrect.

References:

https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/replication-config-for-kms-objects.html

https://aws.amazon.com/blogs/storage/changing-your-amazon-s3-encryption-from-s3-managed-encryption-sse-s3-to-aws-key-management-service-sse-kms/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 24Skipped

An application runs on a fleet of Amazon ECS instances and stores data in an Amazon S3 bucket. Until recently the application had been working well and then started to fail to upload objects to the S3 bucket. Server access logging has been enabled and 403 errors have been identified since the time of the fault. The ECS cluster has been setup according to best practices and no changes have been made to the S3 bucket policy or IAM roles used to access the bucket.

What is the most LIKELY cause of the failure?

Correct answer

The ECS task IAM role was modified.

The ECS tasks have insufficient memory assigned.

The ECS container instance IAM role was modified.

The ECS service in inaccessible.

Overall explanation

A 403 error is an access denied error. Therefore, there must be an issue relating to authorization to access the S3 bucket. In this scenario the bucket policy and IAM roles have not been modified. The next thing to check is that the IAM role is correctly assigned to the ECS tasks.

The most likely cause of this issue is that the ECS task role has been changed and the tasks no longer have the permissions to access S3.

CORRECT: "The ECS task IAM role was modified" is the correct answer.

INCORRECT: "The ECS container instance IAM role was modified" is incorrect. According to best practice the permissions that containers (tasks) require should be specified in task IAM roles not in container instance IAM roles. As the cluster has been setup according to best practice the permissions to S3 should not be specified in the container instance IAM role.

INCORRECT: "The ECS service in inaccessible" is incorrect. This would not result in an access denied error.

INCORRECT: "The ECS tasks have insufficient memory assigned" is incorrect. This would not result in an access denied error.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/s3-troubleshoot-403/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

Domain

AWS Compute

Question 25Skipped

A company has several Amazon RDS databases each with over 50 TB of data. Management have requested that ability to generate a weekly business report from the databases. The system should support ad-hoc SQL queries.

What is the MOST cost-effective solution for the Business Intelligence platform?

Create an AWS Glue ETL job that copies data from the RDS databases to a single Amazon Aurora MySQL database. Run SQL queries on the Aurora MySQL database.

Correct answer

Configure an AWS Glue crawler to crawl the databases and create tables in the AWS Glue Data Catalog. Create an AWS Glue ETL job that loads data from the RDS databases to Amazon S3. Use Amazon Athena to run the queries.

Create an Amazon EMR cluster. Create an AWS Glue ETL job to copy data from the RDS databases to the Amazon Redshift cluster. Use Amazon QuickSight to run the query.

Create an Amazon Redshift cluster. Create an AWS Glue ETL job to copy data from the RDS databases to the Amazon Redshift cluster. Use Amazon Redshift to run the query.

Overall explanation

The lowest cost option is to extract the data to Amazon S3 using a Glue ETL job. Tables can be created in the Glue Data Catalog and Amazon Athena can be used to run the queries. This is a fully serverless solution that meets all requirements.

CORRECT: "Configure an AWS Glue crawler to crawl the databases and create tables in the AWS Glue Data Catalog. Create an AWS Glue ETL job that loads data from the RDS databases to Amazon S3. Use Amazon Athena to run the queries" is the correct answer.

INCORRECT: "Create an Amazon Redshift cluster. Create an AWS Glue ETL job to copy data from the RDS databases to the Amazon Redshift cluster. Use Amazon Redshift to run the query" is incorrect. This solution requires instances to be running in the RedShift cluster so it will be more costly.

INCORRECT: "Create an AWS Glue ETL job that copies data from the RDS databases to a single Amazon Aurora MySQL database. Run SQL queries on the Aurora MySQL database" is incorrect. This solution requires instances to be running in the Aurora cluster so it will be more costly.

INCORRECT: "Create an Amazon EMR cluster. Create an AWS Glue ETL job to copy data from the RDS databases to the Amazon Redshift cluster. Use Amazon QuickSight to run the query" is incorrect. This solution requires instances to be running in the EMR cluster so it will be more costly.

References:

https://docs.aws.amazon.com/athena/latest/ug/glue-best-practices.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-analytics-sap/

Domain

AWS Analytics

Question 26Skipped

A company needs to deploy an application into an AWS Region across multiple Availability Zones and has several requirements for the deployment. The application requires access to 100 GB of static data before the application starts and must be able to scale up and down quickly. Startup time must be minimized as much as possible. The Operations team must be able to install critical OS patches within 48 hours of release. The solution should also be cost-effective.

Which deployment strategy meets these requirements?

Use Amazon EC2 Auto Scaling with a standard AMI. Use a user data script to download the static data from an Amazon S3 bucket. Update the OS patches with AWS Systems Manager.

Use Amazon EC2 Auto Scaling with an AMI that includes the static data. Update the OS patches with AWS Systems Manager.

Correct answer

Use Amazon EC2 Auto Scaling with an AMI that includes the latest OS patches. Mount an Amazon EFS file system with the static data to the EC2 instances at launch time.

Use Amazon EC2 Auto Scaling with an AMI that includes the latest OS patches. Mount a shared Amazon EBS volume with the static data to the EC2 instances at launch time.

Overall explanation

An Auto Scaling group should be used across multiple AZs. The AMI included should include the latest OS patches and the launch config / template should be replaced with a new AMI that includes updated OS patches whenever the critical patches are released. An Amazon EFS file system can be mounted to the instances that has the 100 GB of static data.

CORRECT: "Use Amazon EC2 Auto Scaling with an AMI that includes the latest OS patches. Mount an Amazon EFS file system with the static data to the EC2 instances at launch time" is the correct answer.

INCORRECT: "Use Amazon EC2 Auto Scaling with an AMI that includes the latest OS patches. Mount a shared Amazon EBS volume with the static data to the EC2 instances at launch time" is incorrect. You can mount a shared EBS volume but with certain constraints including that the instances must be in the same AZ.

INCORRECT: "Use Amazon EC2 Auto Scaling with a standard AMI. Use a user data script to download the static data from an Amazon S3 bucket. Update the OS patches with AWS Systems Manager" is incorrect. Downloading the data from S3 will take time and also will mean each instance has a copy in its EBS volume increasing data storage costs.

INCORRECT: "Use Amazon EC2 Auto Scaling with an AMI that includes the static data. Update the OS patches with AWS Systems Manager" is incorrect. This will increase data storage costs as the data will be included in the EBS volumes for every instance.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-walk-patch-windows-ami-autoscaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

Domain

AWS Compute

Question 27Skipped

A company stores highly confidential information in an Amazon S3 bucket. The security team have evaluated the security of the configuration and have come up with some new requirements that must be met. The security team now requires the ability to identify the IP addresses that make requests to the bucket to be able to identify malicious actors. They additionally require that any changes to the bucket policy are automatically remediated and alerts of these changes are sent to their team members.

Which strategies should a Solutions Architect use to meet these requirements?

Correct answer

Identify the IP addresses in Amazon S3 requests with Amazon S3 access logs and Amazon Athena. Use AWS Config with Auto Remediation to remediate any changes to S3 bucket policies. Configure alerting with AWS Config and Amazon SNS.

Create an AWS CloudTrail trail and log management events. Use CloudWatch Events rules with AWS Lambda to automatically remediate S3 bucket policy changes. Configure alerting with Amazon SNS.

Use Amazon Macie with to identify the IP addresses in Amazon S3 requests. Use AWS Lambda with Macie to automatically remediate S3 bucket policy changes. Use Macie automatic alerting capabilities for alerts.

Use Amazon CloudWatch Logs with the Amazon Athena connector to identify the IP addresses in Amazon S3 requests. Use CloudWatch Events rules with AWS Lambda to automatically remediate S3 bucket policy changes. Configure alerting with Amazon SNS.

Overall explanation

Amazon S3 server access logging provides detailed records for the requests that are made to a bucket. This includes the IP addresses that issued the requests. S3 stores server access logs as objects in an S3 bucket. Athena can then be used to query Amazon S3 access logs using SQL queries.

The AWS Config Auto Remediation feature automatically remediates non-compliant resources evaluated by AWS Config rules. You can associate remediation actions with AWS Config rules and choose to execute them automatically to address non-compliant resources without manual intervention. An AWS Config rule can be applied to identify and remediate any unauthorized changes to the policy associated with the S3 bucket. Amazon SNS can be integrated as a destination for alerts.

CORRECT: "Identify the IP addresses in Amazon S3 requests with Amazon S3 access logs and Amazon Athena. Use AWS Config with Auto Remediation to remediate any changes to S3 bucket policies. Configure alerting with AWS Config and Amazon SNS" is the correct answer.

INCORRECT: "Use Amazon CloudWatch Logs with the Amazon Athena connector to identify the IP addresses in Amazon S3 requests. Use CloudWatch Events rules with AWS Lambda to automatically remediate S3 bucket policy changes. Configure alerting with Amazon SNS" is incorrect. CloudWatch Logs will not contain information about the IP addresses that issued requests to Amazon S3, AWS CloudTrail should be used instead.

INCORRECT: "Use Amazon Macie with to identify the IP addresses in Amazon S3 requests. Use AWS Lambda with Macie to automatically remediate S3 bucket policy changes. Use Macie automatic alerting capabilities for alerts" is incorrect. Macie is used to identify personally identifiable information rather than IP addresses.

INCORRECT: "Create an AWS CloudTrail trail and log management events. Use CloudWatch Events rules with AWS Lambda to automatically remediate S3 bucket policy changes. Configure alerting with Amazon SNS" is incorrect. CloudTrail can be used to identify object-level actions but you must enable object-level events, not management events.

References:

https://aws.amazon.com/blogs/mt/aws-config-auto-remediation-s3-compliance/

https://docs.aws.amazon.com/AmazonS3/latest/dev/using-s3-access-logs-to-identify-requests.html#querying-s3-access-logs-for-requests

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Analytics

Question 28Skipped

A Solutions Architect is designing a publicly accessible web application that runs from an Amazon S3 website endpoint. The S3 website is the origin for an Amazon CloudFront distribution. After deploying the solution the operations team ran some tests and received an “Error 403: Access Denied message” when attempting to connect.

What should the Solutions Architect check to determine the root cause of the issue? (Select TWO.)

Correct selection

Check if the S3 block public access option is enabled on the S3 bucket.

Check if object lock is enabled for the objects in the S3 bucket.

Check if the storage class for objects in the S3 Standard.

Correct selection

Check if the S3 bucket is encrypted using AWS KMS.

Check the object versioning status of the objects in the S3 bucket.

Overall explanation

If your CloudFront distribution is using a website endpoint, verify the following requirements to avoid Access Denied errors:

• Objects in the bucket must be publicly accessible.

• Objects in the bucket can't be encrypted by AWS Key Management Service (AWS KMS).

• The bucket policy must allow access to s3:GetObject.

• If the bucket policy grants public read access, then the AWS account that owns the bucket must also own the object.

• The requested objects must exist in the bucket.

• Amazon S3 Block Public Access must be disabled on the bucket.

• If Requester Pays is enabled, then the request must include the request-payer parameter.

• If you're using a Referer header to restrict access from CloudFront to your S3 origin, then review the custom header.

From this list of potential causes for Access Denied errors we can ascertain that the Solutions Architect should verify if the S3 block public access option is enabled, and whether KMS encryption is enabled on the bucket.

CORRECT: "Check if the S3 block public access option is enabled on the S3 bucket" is a correct answer.

CORRECT: "Check if the S3 bucket is encrypted using AWS KMS" is also a correct answer.

INCORRECT: "Check if object lock is enabled for the objects in the S3 bucket" is incorrect. Object Lock helps prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely. This is not a potential cause of an Access Denied error when trying to connect to the website endpoint.

INCORRECT: "Check if the storage class for objects in the S3 Standard" is incorrect. The storage class does not need to be S3 Standard. There are other storage classes that would work with this solution.

INCORRECT: "Check the object versioning status of the objects in the S3 bucket" is incorrect. The versioning status is not relevant here.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/s3-website-cloudfront-error-403/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

Domain

AWS Storage

Question 29Skipped

A company has a security policy that requires that all internal application connectivity must use private IP addresses. A Solutions Architect has created interface endpoints in private subnets to connect to AWS public services. The Solutions Architect tested the configuration and the connectivity failed.

Which configuration change should the Solutions Architect make to resolve the issue?

Configure an Amazon Route 53 private hosted zone with a conditional forwarder for the internal application.

Enable the private DNS option on the VPC attributes.

Update the route table for the subnets with a route to the interface endpoint.

Correct answer

Configure the security group on the interface endpoint to allow connectivity to the AWS services.

Overall explanation

You must ensure that the security group that's associated with the endpoint network interface allows communication between the endpoint network interface and the resources in your VPC that communicate with the service.

When you create an interface endpoint, endpoint-specific DNS hostnames are generated. For AWS services and AWS Marketplace Partner services, the private DNS option (enabled by default) associates a private hosted zone with your VPC.

The hosted zone contains a record set for the default DNS name for the service (for example, ec2.us-east-1.amazonaws.com) that resolves to the private IP addresses of the endpoint network interfaces in your VPC. This enables you to make requests to the service using its default DNS hostname instead of the endpoint-specific DNS hostnames.

With Private DNS enabled on the endpoint, instances can send requests AWS services through the interface endpoint using either the default DNS hostname or the endpoint-specific DNS hostname.

CORRECT: "Configure the security group on the interface endpoint to allow connectivity to the AWS services" is the correct answer.

INCORRECT: "Enable the private DNS option on the VPC attributes" is incorrect. Private DNS is enabled by default for endpoints created for AWS services and AWS Marketplace Partner services.

INCORRECT: "Update the route table for the subnets with a route to the interface endpoint" is incorrect. You do not need to update the route table for interface endpoints.

INCORRECT: "Configure an Amazon Route 53 private hosted zone with a conditional forwarder for the internal application" is incorrect. This is unnecessary, a private hosted zone is a private hosted zone is associated with the VPC by default when the private DNS option is enabled (which is a default).

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html

https://docs.aws.amazon.com/vpc/latest/userguide/verify-domains.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 30Skipped

A company has a line of business (LOB) application that is used for storing sales data for an eCommerce platform. The data is unstructured and stored in an Oracle database running on a single Amazon EC2 instance. The application front end consists of six EC2 instances in three Availability Zones (AZs). Each week the application receives bursts of traffic and application performance suffers. A Solutions Architect must design a solution to address scalability and reliability. The solutions should also eliminate licensing costs.

Which set of steps should the Solutions Architect take?

Correct answer

Create an Auto Scaling group for the front end with a combination of Reserved instances and Spot Instances to reduce costs. Convert the tables in the Oracle database into Amazon DynamoDB tables.

Create an Auto Scaling group for the front end with a combination of On-Demand and Spot Instances to reduce costs. Migrate the Oracle database into a single Amazon RDS reserved DB instance.

Use Spot Instances for the front end to reduce costs. Convert the tables in the Oracle database into Amazon DynamoDB tables.

Create an Auto Scaling group for the front end with a combination of Reserved instances and Spot Instances to reduce costs. Migrate the Oracle database into an Amazon RDS multi-AZ deployment.

Overall explanation

The front end can be served by a combination of reserved instances and spot instances to reduce cost. As this is a LOB application we can assume that it will be around for a long time so an RI is suitable.

For the database layer this can be migrated to DynamoDB. In the case of Oracle not all features are supported when migrating to DynamoDB but for hosting unstructured data and eliminating licensing costs this could be a good solution. AWS DMS can be used to migrate the database and convert the tables.

CORRECT: "Create an Auto Scaling group for the front end with a combination of Reserved instances and Spot Instances to reduce costs. Convert the tables in the Oracle database into Amazon DynamoDB tables" is the correct answer.

INCORRECT: "Create an Auto Scaling group for the front end with a combination of On-Demand and Spot Instances to reduce costs. Migrate the Oracle database into a single Amazon RDS reserved DB instance" is incorrect. This will not eliminate the licensing costs as Oracle on RDS is still subject to licensing.

INCORRECT: "Create an Auto Scaling group for the front end with a combination of Reserved instances and Spot Instances to reduce costs. Migrate the Oracle database into an Amazon RDS multi-AZ deployment" is incorrect. As above, Oracle on RDS does not eliminate licensing.

INCORRECT: "Use Spot Instances for the front end to reduce costs. Convert the tables in the Oracle database into Amazon DynamoDB tables" is incorrect. Spot instances reduce cost but do not increase reliability as they are subject to termination of the maximum configured price is exceeded.

References:

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/migrate-from-an-on-premises-oracle-database-or-amazon-rds-for-oracle-to-amazon-dynamodb-using-aws-dms-and-aws-sct.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-migration-sap/

Domain

AWS Compute

Question 31Skipped

A security team has discovered that developers have been storing IAM secret access keys in AWS CodeCommit repositories. The security team requires that measures are put in place to automatically find and remediate all instances of this vulnerability on an ongoing basis.

Which solution meets these requirements?

Use AWS Trusted Advisor to check for unsecured AWS credentials. If any unsecured credentials are found, use AWS Secrets Manager to rotate the credentials.

Create an Amazon Macie job that scans AWS CodeCommit repositories for credentials. If any credentials are found an AWS Lambda function should be triggered that disables the credentials.

Run a cron job on an Amazon EC2 instance to check the CodeCommit repositories for unsecured credentials. If any unsecured credentials are found, generate new credentials and store them in AWS KMS.

Correct answer

Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials. If any credentials are found, disable them and notify the user.

Overall explanation

You can configure a CodeCommit repository so that code pushes or other events trigger actions, such as sending a notification from Amazon Simple Notification Service (Amazon SNS) or invoking a function in AWS Lambda. You can create up to 10 triggers for each CodeCommit repository. In this case you can trigger AWS Lambda to scan the code for access keys

CORRECT: "Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials. If any credentials are found, disable them and notify the user" is correct.

INCORRECT: "Create an Amazon Macie job that scans AWS CodeCommit repositories for credentials. If any credentials are found an AWS Lambda function should be triggered that disables the credentials" is incorrect. Macie scans Amazon S3 buckets but you cannot see the S3 bucket assigned to CodeCommit as it’s an AWS managed service bucket.

INCORRECT: "Use AWS Trusted Advisor to check for unsecured AWS credentials. If any unsecured credentials are found, use AWS Secrets Manager to rotate the credentials" is incorrect. Secrets Manager cannot be used for rotating secret access keys.

INCORRECT: "Run a cron job on an Amazon EC2 instance to check the CodeCommit repositories for unsecured credentials. If any unsecured credentials are found, generate new credentials and store them in AWS KMS" is incorrect. EC2 is not a very cost-effective option for running this task and KMS is used for storing encryption keys, not secret access keys.

References:

https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-notify.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Security, Identity, & Compliance

Question 32Skipped

A company has an application that generates data exports which are saved as CSV files in an Amazon S3 bucket. The data is generally confidential and only accessed by IAM users. An individual CSV file must be shared with an external organization. A Solutions Architect used an IAM user account to attempt to perform a PUT Object call to enable a public ACL on the object and it failed with “insufficient permissions”.

What is the most likely cause of this issue?

The object ACL does not allow write permissions for the IAM user account.

Correct answer

The bucket has the BlockPublicAcls setting set to TRUE.

The bucket has the BlockPublicPolicy setting set to TRUE.

The object has a policy assigned that blocks all public access.

Overall explanation

The Amazon S3 Block Public Access feature provides settings for access points, buckets, and accounts to help you manage public access to Amazon S3 resources. By default, new buckets, access points, and objects don't allow public access.

S3 Block Public Access provides four settings. You can apply these settings in any combination to individual access points, buckets, or entire AWS accounts. If you apply a setting to an account, it applies to all buckets and access points that are owned by that account. Similarly, if you apply a setting to a bucket, it applies to all access points associated with that bucket.

The settings you can configure with the Block Public Access Feature are:

- IgnorePublicAcls - causes Amazon S3 to ignore all public ACLs on a bucket and any objects that it contains.

- BlockPublicAcls – PUT bucket ACL and PUT objects requests are blocked if granting public access.

- BlockPublicPolicy – Rejects requests to PUT a bucket policy if granting public access.

- RestrictPublicBuckets – Restricts access to principles in the bucket owners’ AWS account.

CORRECT: "The bucket has the BlockPublicAcls setting set to TRUE" is the correct answer.

INCORRECT: "The object ACL does not allow write permissions for the IAM user account" is incorrect. IAM user accounts are not specified on object ACLs. The object owner (AWS account) should have full permissions by default.

INCORRECT: "The bucket has the BlockPublicPolicy setting set to TRUE" is incorrect. This would reject any attempts to add a bucket policy that enables public access.

INCORRECT: "The object has a policy assigned that blocks all public access" is incorrect. You cannot assign policies to objects, they are assigned to buckets.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

Domain

AWS Storage

Question 33Skipped

A financial services company is developing a secure web application on AWS. This application will handle sensitive customer data and needs to be accessible only within the company's corporate network. The application is hosted on Amazon EC2 instances within a VPC. The company wants to ensure that this web application is not accessible from the public internet for enhanced security.

As AWS solutions architect must ensure that the web application is only accessible from the company's corporate network and not from the public internet. Which action should be taken?

Create an Elastic Load Balancer (ELB) and configure it to only accept traffic from the company's corporate network IP range. Attach the ELB to the EC2 instances hosting the web application.

Deploy an Amazon CloudFront distribution and configure it with an origin access identity (OAI) to restrict access to the EC2 instances.

Correct answer

Create a VPN connection between the company’s corporate network and the VPC. Configure security groups for the EC2 instances to only allow traffic from the VPN connection.

Create a NAT Gateway and configure route tables to allow traffic only from the corporate network IP range to the EC2 instances.

Overall explanation

Setting up a VPN connection between the company's corporate network and the AWS VPC, and configuring security groups for the EC2 instances to only allow traffic from this VPN connection, ensures that the application is accessible only from within the company’s network.

This setup maintains a secure, private connection and meets the requirement of not being accessible from the public internet.

CORRECT: "Create a VPN connection between the company’s corporate network and the VPC. Configure security groups for the EC2 instances to only allow traffic from the VPN connection" is the correct answer (as explained above.)

INCORRECT: "Create an Elastic Load Balancer (ELB) and configure it to only accept traffic from the company's corporate network IP range. Attach the ELB to the EC2 instances hosting the web application" is incorrect.

While an ELB can restrict traffic to certain IP ranges, it is typically used for load balancing internet-facing traffic and does not inherently prevent public internet access.

INCORRECT: "Create a NAT Gateway and configure route tables to allow traffic only from the corporate network IP range to the EC2 instances" is incorrect.

A NAT Gateway is used to enable instances in a private subnet to connect to the internet or other AWS services. It does not restrict inbound access to the application from the public internet.

INCORRECT: "Deploy an Amazon CloudFront distribution and configure it with an origin access identity (OAI) to restrict access to the EC2 instances" is incorrect.

Amazon CloudFront with an OAI is typically used for content delivery and caching; it does not inherently restrict application access to a corporate network. CloudFront distributions can still be accessed from the public internet unless additional configurations are implemented.

References:

https://docs.aws.amazon.com/vpn/latest/s2svpn/security.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 34Skipped

A healthcare organization is planning to transition its on-premises data processing workloads to AWS. Before migration, the organization needs a thorough assessment of its current server infrastructure to determine appropriate sizing for Amazon EC2 instances. Key data to be collected includes CPU and memory usage, network I/O, and a list of active services on each server. Additionally, the organization wants to analyze network traffic patterns to understand dependencies between servers.

What is the most cost-effective method to gather this comprehensive data for migration planning?

Configure Amazon CloudWatch agents on all on-premises servers to collect the required metrics and send the data to Amazon CloudWatch for analysis and storage.

Activate AWS Application Discovery Service via the AWS Management Console and set up network traffic mirroring to capture and analyze inter-server communication and usage metrics.

Correct answer

Implement AWS Application Discovery Service with the installation of its data collection agent on each server in the organization's data center to gather detailed server usage and network data.

Use AWS Application Discovery Service with agentless discovery configured in the organization's virtualized environment to collect the necessary server and network information.

Overall explanation

AWS Application Discovery Service is specifically designed to assist organizations in collecting detailed information about their on-premises infrastructure, which is crucial for cloud migration planning.

By deploying the data collection agent on each server, the organization can obtain in-depth data on server performance, including CPU and memory usage, network I/O, and running services.

This detailed level of data collection, including network traffic analysis, is essential for accurately determining the sizing and configuration of Amazon EC2 instances for the migration.

This approach ensures a comprehensive assessment with minimal cost implications, as it leverages AWS's native tools designed for migration planning.

CORRECT: "Implement AWS Application Discovery Service with the installation of its data collection agent on each server in the organization's data center to gather detailed server usage and network data" is the correct answer (as explained above.)

INCORRECT: "Configure Amazon CloudWatch agents on all on-premises servers to collect the required metrics and send the data to Amazon CloudWatch for analysis and storage" is incorrect.

While Amazon CloudWatch agents can collect a wide range of metrics, they are primarily designed for monitoring AWS resources. Using CloudWatch agents for on-premises servers would not provide the same level of detailed discovery and analysis for migration planning as AWS Application Discovery Service. Additionally, CloudWatch is more focused on monitoring rather than assessing and planning migrations.

INCORRECT: "Use AWS Application Discovery Service with agentless discovery configured in the organization's virtualized environment to collect the necessary server and network information" is incorrect.

The agentless discovery option in AWS Application Discovery Service is generally used for gathering basic server information in virtualized environments. It might not provide as detailed or comprehensive data (especially regarding network dependencies and service inventory) as the agent-based discovery.

INCORRECT: "Activate AWS Application Discovery Service via the AWS Management Console and set up network traffic mirroring to capture and analyze inter-server communication and usage metrics" is incorrect.

AWS Application Discovery Service does not natively support network traffic mirroring. This option would not be as effective in collecting the detailed server and application usage data required for thorough migration planning.

References:

https://docs.aws.amazon.com/application-discovery/latest/userguide/what-is-appdiscovery.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 35Skipped

An application publishes data continuously to Amazon DynamoDB using an AWS Lambda function. The DynamoDB table has an auto scaling policy enabled with the target utilization set to 70%. There are short predictable periods in which a large volume of data is received and this can exceed the typical load by up to 300%. The AWS Lambda function writes
ProvisionedThroughputExceededException messages to Amazon CloudWatch Logs during these times, and some records are redirected to the dead letter queue.
What change should the company make to resolve this issue?

Correct answer

Use Application Auto Scaling to scale out write capacity on the DynamoDB table based on a schedule.

Use Amazon CloudWatch Events to monitor the dead letter queue and invoke a Lambda function to automatically retry failed records.

Use Application Auto Scaling to set a step scaling policy to scale out write capacity on the DynamoDB table when load spikes reach a defined threshold.

Reduce the DynamoDB table auto scaling policy's target utilization to 50% to provide more resources for peak traffic periods.

Overall explanation

The error message received will include the following statement:

You exceeded your maximum allowed provisioned throughput for a table or for one or more global secondary indexes.

This indicates that the table’s capacity is insufficient for the load. The best way to resolve this for a predictable spike in traffic is to configure Application Auto Scaling to scale based on a defined schedule.

Scaling based on a schedule allows you to set your own scaling schedule for predictable load changes. For example, every week the traffic to your web application starts to increase on Wednesday, remains high on Thursday, and starts to decrease on Friday. You can configure Application Auto Scaling to increase capacity on Wednesday and decrease capacity on Friday.

CORRECT: "Use Application Auto Scaling to scale out write capacity on the DynamoDB table based on a schedule" is the correct answer.

INCORRECT: "Use Application Auto Scaling to set a step scaling policy to scale out write capacity on the DynamoDB table when load spikes reach a defined threshold" is incorrect. Step scaling is a dynamic scaling type that will scale when the load increases and scales according to the size of the alarm breach. However, this method must respond to alarm breaches and therefore may still result in errors. Scheduled scaling is preferable as it ensures the additional capacity is enabled before the increase in load occurs.

INCORRECT: "Use Amazon CloudWatch Events to monitor the dead letter queue and invoke a Lambda function to automatically retry failed records" is incorrect. This does not solve the original problem and the records may still fail to be written if the load has not decreased.

INCORRECT: "Reduce the DynamoDB table auto scaling policy's target utilization to 50% to provide more resources for peak traffic periods" is incorrect. This will still result in an alarm breach if the utilization goes above 50% and is less cost-effective.

References:

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

Domain

AWS Database

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries