Practice Exam AWS Certified Solutions Architect Professional

Practice Test 3: Full Practice Test #3 - AWS Certified Solutions Architect Professional
Open

Practice Test 2: Full Practice Test #2 - AWS Certi…

Set a certification due date

AWS Certified Solutions Architect – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: Mini Practice Test #1 - AWS Certified Solutions Architect Professional

Start

Practice Test 2: Full Practice Test #2 - AWS Certified Solutions Architect Professional

Start

Practice Test 3: Full Practice Test #3 - AWS Certified Solutions Architect Professional

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

Prepare for your SAP-C02 exam. 180 high-quality practice test questions written from scratch with detailed explanations!

Rating: 4.5 out of 54.5
3,312 ratings

47,558

Students

180 questions

Total

Last updated June 2024

English

What you'll learn

Guaranteed chance to pass the exam if you score 90%+ on each practice exam

Ace your AWS Certified Solutions Architect Professional SAP-C01 exam

Practice with high quality practice exams alongside detailed explanation to learn concepts

The SAP-C01 exams practice exams have been written from scratch

Perfect companion to the "Ultimate AWS Certified Solutions Architect Professional" course by Stephane Maarek

Description

Preparing for AWS Certified Solutions Architect Professional SAP-C02? This is THE practice exams course to give you the winning edge.

These practice exams have been co-authored by Stephane Maarek and Abhishek Singh who bring their collective experience of passing 18 AWS Certifications to the table.

The tone and tenor of the questions mimic the real exam. Along with the detailed description and “exam alert” provided within the explanations, we have also extensively referenced AWS documentation to get you up to speed on all domain areas being tested for the SAP-C02 exam.

We want you to think of this course as the final pit-stop so that you can cross the winning line with absolute confidence and get AWS Certified! Trust our process, you are in good hands.

All questions have been written from scratch! And more questions are being added over time!

=======

Quality speaks for itself...

SAMPLE QUESTION:

A silicon valley based unicorn startup recently launched a video-sharing social networking service called KitKot. The startup uses AWS Cloud to manage the IT infrastructure. Users upload video files up to 1 GB in size to a single EC2 instance based application server which stores them on a shared EFS file system. Another set of EC2 instances managed via an Auto Scaling group, periodically scans the EFS share directory for new files to process and generate new videos (for thumbnails and composite visual effects) according to the video processing instructions that are uploaded alongside the raw video files. Post-processing, the raw video files are deleted from the EFS file system and the results are stored in an S3 bucket. Links to the processed video files are sent via in-app notifications to the users. The startup has recently found that even as more instances are added to the Auto Scaling Group, many files are processed twice, therefore image processing speed is not improved.

As an AWS Certified Solutions Architect Professional, what would you recommend to improve the reliability of the solution as well as eliminate the redundant processing of video files?

Refactor the application to run from Amazon S3 instead of the EFS file system and upload the video files directly to an S3 bucket via an API Gateway based REST API. Configure an S3 trigger to invoke a Lambda function each time a file is uploaded and the Lambda in turn processes the video and stores the processed files in another bucket. Leverage CloudWatch Events to trigger an SNS notification to send an in-app notification to the user containing the links to the processed files

Refactor the application to run from S3 instead of EFS and upload the video files directly to an S3 bucket. Configure an S3 trigger to invoke a Lambda function on each video file upload to S3 that puts a message in an SQS queue containing the link and the video processing instructions. Change the video processing application to read from the SQS queue and the S3 bucket. Configure the queue depth metric to scale the size of the Auto Scaling group for video processing instances. Leverage CloudWatch Events to trigger an SNS notification to the user containing the links to the processed files

Refactor the application to run from S3 instead of EFS and upload the video files directly to an S3 bucket. Set up an EventBridge event to trigger a Lambda function on each file upload that puts a message in an SQS queue containing the link and the video processing instructions. Change the video processing application to read from SQS queue for new files and configure the queue depth metric to scale instances in the video processing Auto Scaling group. Leverage EventBridge events to trigger an SNS notification to the user containing the links to the processed files

Create an hourly cron job on the application server to synchronize the contents of the EFS share with S3. Trigger a Lambda function every time a file is uploaded to S3 and process the video file to store the results in another S3 bucket. Once the file is processed, leverage CloudWatch Events to trigger an SNS notification to send an in-app notification to the user containing the links to the processed files

What's your guess? Scroll below for the answer...

Correct: 2.

Refactor the application to run from S3 instead of EFS and upload the video files directly to an S3 bucket. Configure an S3 trigger to invoke a Lambda function on each video file upload to S3 that puts a message in an SQS queue containing the link and the video processing instructions. Change the video processing application to read from the SQS queue and the S3 bucket. Configure the queue depth metric to scale the size of the Auto Scaling group for video processing instances. Leverage CloudWatch Events to trigger an SNS notification to the user containing the links to the processed files

For the given use-case, the primary way to address the issues related to reliability, as well as redundant processing of video files, is by introducing SQS into the solution stack. SQS offers a secure, durable, and available hosted queue that lets you integrate and decouple distributed software systems and components. SQS locks your messages during processing, so that multiple producers can send and multiple consumers can receive messages at the same time. Using the right combination of delay queues and visibility timeout, you can optimize the solution to address use-cases where the consumer application needs additional time to process messages such as the one in this scenario. Messages are put into the SQS queue via a Lambda function that is triggered when a new video file is uploaded to S3 for processing.

To ensure that the consumer applications running on the video processing instances can scale via an Auto Scaling group, you could use the SQS queue depth (known as the CloudWatch Amazon SQS metric - ApproximateNumberOfMessages) as the underlying metric. However, the issue with using a CloudWatch Amazon SQS metric like ApproximateNumberOfMessagesVisible for target tracking is that the number of messages in the queue might not change proportionally to the size of the Auto Scaling group that processes messages from the queue. An optimized solution would be to use a backlog per instance metric with the target value being the acceptable backlog per instance to maintain.

Incorrect options:

Refactor the application to run from Amazon S3 instead of the EFS file system and upload the video files directly to an S3 bucket via an API Gateway based REST API. Configure an S3 trigger to invoke a Lambda function each time a file is uploaded and the Lambda, in turn, processes the video and stores the processed files in another bucket. Leverage CloudWatch Events to trigger an SNS notification to send an in-app notification to the user containing the links to the processed files - API Gateway supports payload size of only up to 10 MB therefore this option is incorrect for the given use-case since you need to support file sizes of up to 1GB for video processing.

Refactor the application to run from S3 instead of EFS and upload the video files directly to an S3 bucket. Set up an EventBridge event to trigger a Lambda function on each file upload that puts a message in an SQS queue containing the link and the video processing instructions. Change the video processing application to read from SQS queue for new files and configure the queue depth metric to scale instances in the video processing Auto Scaling group. Leverage EventBridge events to trigger an SNS notification to the user containing the links to the processed files - You can certainly configure an EventBridge event to handle a new object upload on S3, which in turn triggers a lambda function. However, this is a roundabout way of propagating the object upload event to the Lambda function. So this is not the best fit option.

Create an hourly cron job on the application server to synchronize the contents of the EFS share with S3. Trigger a Lambda function every time a file is uploaded to S3 and process the video file to store the results in another S3 bucket. Once the file is processed, leverage CloudWatch Events to trigger an SNS notification to send an in-app notification to the user containing the links to the processed files - The issue with this option is lack of reliability. In case the Lambda function (which is triggered when a video file is uploaded to S3) fails to process a given video file, then the source video file would always remain unprocessed as there is no queue-based mechanism to re-process failed events. So this option is incorrect.

< with reference links>

=======

Instructor

My name is Stéphane Maarek, I am passionate about Cloud Computing, and I will be your instructor in this course. I teach about AWS certifications, focusing on helping my students improve their professional proficiencies in AWS.

I have already taught 1,500,000+ students and gotten 500,000+ reviews throughout my career in designing and delivering these certifications and courses!

I'm delighted to welcome Abhishek Singh as my co-instructor for these practice exams!

=======

Welcome to the best practice exams to help you prepare for your AWS Certified Solutions Architect Professional exam.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app

30-days money-back guarantee if you're not satisfied

We hope that by now you're convinced!... And there are a lot more questions inside the course.

Happy learning and best of luck for your AWS Certified Solutions Architect Professional SAP-C02 exam!

Who this course is for:

Anyone preparing for the AWS Certified Solutions Architect Professional SAP-C01

Show moreShow less

Instructors

Stephane Maarek | AWS Certified Cloud Practitioner,Solutions Architect,Developer

Best Selling Instructor, 11x AWS Certified, Kafka Guru

Stephane is a solutions architect, consultant and software developer that has a particular interest in all things related to Cloud & Big Data. He's also a many-times best seller instructor on Udemy for his courses in AWS and Apache Kafka.

[See FAQ below to see in which order you can take my courses]

Stéphane is recognized as an AWS Hero and is an AWS Certified Solutions Architect Professional & AWS Certified DevOps Professional. He loves to teach people how to use the AWS properly, to get them ready for their AWS certifications, and most importantly for the real world.

He also loves Apache Kafka. He used on the Program Committee organizing the Kafka Summit in New York, London and San Francisco. He also was an active member of the Apache Kafka community, and has authored blogs on Medium and the guest blog for Confluent. He also has co-founded Conduktor, a prominent company in the Kafka ecosystem.

During his spare time he enjoys cooking, practicing yoga, surfing, watching TV shows, and traveling to awesome destinations!

FAQ: In which order should you learn?...

AWS Cloud: Start with AWS Certified Cloud Practitioner or AWS Certified Solutions Architect Associate, then move on to AWS Certified Developer Associate and then AWS Certified SysOps Administrator. Afterwards you can either do AWS Certified Solutions Architect Professional or AWS Certified DevOps Professional, or a specialty certification of your choosing. You can also learn about AI with the AWS Certified AI Practitioner course!

Apache Kafka: Start with Apache Kafka for Beginners, then you can learn Connect, Streams and Schema Registry if you're a developer, and Setup and Monitoring courses if you're an admin. Both tracks are needed to pass the Confluent Kafka certification.

Show moreShow less

Abhishek Singh

Cloud Evangelist

Abhishek is an AWS veteran and has built successful SaaS and consumer solutions using AWS services since 2012. Over the course of his professional career, Abhishek has interviewed and mentored hundreds of candidates for entry-level and lateral positions for Cloud based IT solutions development. Abhishek is passionate about sharing his knowledge on AWS Cloud, Machine Learning and Big Data. He wants to help his fellow IT Professionals level-up their skills to ace the AWS Certifications and above all, get ready for the real world AWS ecosystem.

He is an AWS Certified Solutions Architect Professional, AWS Certified DevOps Engineer Professional, AWS Certified Machine Learning Specialist, AWS Certified Big Data Specialist and AWS Certified Database Specialist.

Overall, Abhishek has over 15 years of experience working on a diverse range of Enterprise Technologies based on AI/ML, Big Data and Analytics. He runs a successful AI/ML and Big Data Consultancy advocating solutions on AWS Cloud and has advised multiple clients in the US to architect and implement their AI/ML and Big Data solutions using the AWS suite of services.

Show moreShow less

Requirements

Recommended: Preparing for the exam with "Ultimate AWS Certified Solutions Architect Professional" course by Stephane Maarek

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Practice Test 1: Mini Practice Test #1 - AWS Certified Solutions Architect Professional

Practice Test 2: Full Practice Test #2 - AWS Certified Solutions Architect Professional

Practice Test 3: Full Practice Test #3 - AWS Certified Solutions Architect Professional

Practice Test 3: Full Practice Test #3 - AWS Certified Solutions Architect Professional

Full Practice Test #3 - AWS Certified Solutions Architect Professional - Results

Back to result overview
Attempt 3

All domains

All domains

Accelerate Workload Migration and Modernization

Design for New Solutions

Design Solutions for Organizational Complexity

Continuous Improvement for Existing Solutions

75 all

64 correct

11 incorrect

0 skipped

1 marked

Collapse all questions

Question 1Correct

A media streaming service delivers billions of hours of content from Amazon S3 to customers around the world. Amazon S3 also serves as the data lake for its data analytics solution. The data lake has a staging zone where intermediary query results are kept only for 24 hours. These results are also heavily referenced by other parts of the analytics pipeline.

Which of the following is the MOST cost-effective solution to store this intermediary query data?

Store the intermediary query results in S3 Glacier Instant Retrieval storage class

Your answer is correct

Store the intermediary query results in S3 Standard storage class

Store the intermediary query results in S3 Standard-Infrequent Access storage class

Store the intermediary query results in S3 One Zone-Infrequent Access storage class

Overall explanation

Correct option:

Store the intermediary query results in S3 Standard storage class

S3 Standard offers high durability, availability, and performance object storage for frequently accessed data. Because it delivers low latency and high throughput, S3 Standard is appropriate for a wide variety of use cases, including cloud applications, dynamic websites, content distribution, mobile and gaming applications, and big data analytics. As there is no minimum storage duration charge and no retrieval fee (remember that intermediary query results are heavily referenced by other parts of the analytics pipeline), this is the MOST cost-effective storage class amongst the given options.

Incorrect options:

Store the intermediary query results in S3 Glacier Instant Retrieval storage class - The Amazon S3 Glacier storage classes are purpose-built for data archiving. You can choose from three archive storage classes optimized for different access patterns and storage duration with the following use cases: S3 Glacier Instant Retrieval for archive data that needs immediate access, S3 Glacier Flexible Retrieval (formerly S3 Glacier) for rarely accessed long-term data that does not require immediate access, and Amazon S3 Glacier Deep Archive (S3 Glacier Deep Archive) for long-term archive and digital preservation with retrieval in hours at the lowest cost storage in the cloud.

S3 Glacier Instant Retrieval delivers the fastest access to archive storage, with the same throughput and milliseconds access as the S3 Standard and S3 Standard-IA storage classes. S3 Glacier Instant Retrieval is ideal for archive data that needs immediate access, such as medical images, news media assets, or user-generated content archives.

The minimum storage duration charge is 90 days, so this option is NOT cost-effective because intermediary query results need to be kept only for 24 hours. Hence this option is not correct.

Store the intermediary query results in S3 Standard-Infrequent Access storage class - S3 Standard-IA is for data that is accessed less frequently but requires rapid access when needed. S3 Standard-IA offers high durability, high throughput, and low latency of S3 Standard, with a low per GB storage price and per GB retrieval fee. This combination of low cost and high performance makes S3 Standard-IA ideal for long-term storage, backups, and as a data store for disaster recovery files. The minimum storage duration charge is 30 days, so this option is NOT cost-effective because intermediary query results need to be kept only for 24 hours. Hence this option is not correct.

Store the intermediary query results in S3 One Zone-Infrequent Access storage class - S3 One Zone-IA is for data that is accessed less frequently but requires rapid access when needed. Unlike other S3 Storage Classes which store data in a minimum of three Availability Zones (AZs), S3 One Zone-IA stores data in a single AZ and costs 20% less than S3 Standard-IA. The minimum storage duration charge is 30 days, so this option is NOT cost-effective because intermediary query results need to be kept only for 24 hours. Hence this option is not correct.

To summarize again, S3 Standard-IA and S3 One Zone-IA have a minimum storage duration charge of 30 days (so instead of 24 hours, you end up paying for 30 days). S3 Standard-IA and S3 One Zone-IA also have retrieval charges (as the results are heavily referenced by other parts of the analytics pipeline, so the retrieval costs would be pretty high). Therefore, these storage classes are not cost-optimal for the given use case.

Reference:

https://aws.amazon.com/s3/storage-classes/

Domain

Accelerate Workload Migration and Modernization

Question 2Correct

A web application is hosted on a fleet of Amazon EC2 instances running behind an Application Load Balancer (ALB). A custom functionality has mandated the need for a static IP address for the ALB.

As a solutions architect, how will you implement this requirement while keeping the costs to a minimum?

Configure Gateway Load Balancer in front of the Application Load Balancer to provide a static IP address for the ALB

An Elastic IP can be registered to an Application Load Balancer only during the creation. Re-create the ALB with the new Elastic IP and switch the workload to the newly created ALB

Configure Global Accelerator in front of the Application Load Balancer to provide a static IP address for the ALB

Your answer is correct

Register the Application Load Balancer behind a Network Load Balancer that will provide the necessary static IP address to the ALB

Overall explanation

Correct option:

Register the Application Load Balancer behind a Network Load Balancer that will provide the necessary static IP address to the ALB - You can't assign a static IP address to an Application Load Balancer. If you need a static IP address for your Application Load Balancer, it's a best practice to register the Application Load Balancer behind a Network Load Balancer. The static IP address assigned to a Network Load Balancer doesn't change, providing a fixed entry point for your Application Load Balancer.

You can forward traffic from your Network Load Balancer, which provides support for PrivateLink and a static IP address per Availability Zone, to your Application Load Balancer. Create an Application Load Balancer-type target group, register your Application Load Balancer to it, and configure your Network Load Balancer to forward traffic to the Application Load Balancer-type target group.

Incorrect options:

An Elastic IP can be registered to an Application Load Balancer only during the creation. Re-create the ALB with the new Elastic IP and switch the workload to the newly created ALB - An Elastic IP address is a static public IPv4 address associated with your AWS account in a specific Region. Unlike an auto-assigned public IP address, an Elastic IP address is preserved after you stop and start your instance in a virtual private cloud (VPC). An ALB does not support an Elastic IP.

Configure Global Accelerator in front of the Application Load Balancer to provide a static IP address for the ALB - When you create an Application Load Balancer in the AWS Management Console, you can optionally add an accelerator at the same time. Elastic Load Balancing and Global Accelerator work together to transparently add the accelerator for you. The accelerator is created in your account, with the load balancer as an endpoint. Using an accelerator provides static IP addresses and improves the availability and performance of your applications. However, Global Accelerator will not be a cost-effective choice when compared to a Network Load Balancer.

Configure Gateway Load Balancer in front of the Application Load Balancer to provide a static IP address for the ALB - You should use Gateway Load Balancer when deploying inline virtual appliances where network traffic is not destined for the Gateway Load Balancer itself. Gateway Load Balancer transparently passes all Layer 3 traffic through third-party virtual appliances and is invisible to the source and destination of the traffic. This option has been added as a distractor.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/on-premises-direct-connect-traffic/

https://aws.amazon.com/blogs/networking-and-content-delivery/application-load-balancer-type-target-group-for-network-load-balancer/

https://docs.aws.amazon.com/global-accelerator/latest/dg/about-accelerators.alb-accelerator.html

Domain

Accelerate Workload Migration and Modernization

Question 3Correct

A company is delivering web content from an Amazon EC2 instance in a public subnet with address 2022:db8:1:100::1. Users report they are unable to access the web content. The VPC Flow Logs for the subnet contain the following entries:

2 098765432112 eni-0596e500987654321 2022:db8:2:200::2 2022:db8:1:100::1 0 0 58 236 42336 1551200195 1551200434 ACCEPT OK 2 098765432112 eni-0596e500987654321 2022:db8:1:100::1 2022:db8:2:200::2 0 0 58 236 42336 1551200195 1551200434 REJECT OK

Which of the following options will restore network reachability to the EC2 instance?

Your answer is correct

Update the network ACL associated with the subnet to allow outbound traffic

Update the security group associated with the eni-0596e500987654321 to allow outbound traffic

Update the network ACL associated with the eni-0596e500987654321 to allow outbound traffic

Update the security group associated with the subnet to allow outbound traffic

Overall explanation

Correct option:

Update the network ACL associated with the subnet to allow outbound traffic

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs or Amazon S3. You can create a flow log for a VPC, a subnet, or a network interface. If you create a flow log for a subnet or VPC, each network interface in that subnet or VPC is monitored.

via - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

For the given use case, the inbound traffic is accepted however the response traffic has been rejected. If you're using flow logs to diagnose overly restrictive or permissive security group rules or network ACL rules, you should note that the security groups are stateful — this means that responses to allowed traffic are also allowed, even if the rules in your security group do not permit it. Conversely, network ACLs are stateless, therefore responses to allowed traffic are subject to network ACL rules.

via - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html

Incorrect options:

Update the network ACL associated with the eni-0596e500987654321 to allow outbound traffic - A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. A network ACL cannot be associated with ENIs, so this option is incorrect.

Update the security group associated with the eni-0596e500987654321 to allow outbound traffic - Considering the case when a security group's inbound rules allow traffic but the outbound rules do not allow traffic, the response traffic from the instance would still be allowed because security groups are stateful. So this option is incorrect.

Update the security group associated with the subnet to allow outbound traffic - A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Security groups are associated with network interfaces. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups. Security groups cannot be associated with subnets, so this option is incorrect.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

Domain

Design for New Solutions

Question 4Correct

A company has its web application hosted on Amazon EC2 instances that are deployed in a single AWS Region. The company has now expanded its operations into new geographies and the company wants to offer low-latency access for the application to its customers. To comply with different financial regulations of each geography, the application needs to operate in silos and the underlying instances in one region should not interact with instances running in other regions.

Which of the following represents the most optimal solution to automate the application deployment to different AWS regions?

Create a CloudFormation template describing the application infrastructure in the Resources section. Use CloudFormation change set from an administrator account to launch stack instances that deploy the application to various other regions

Create a shell script that uses the AWS CLI to query the current state in one region and output an AWS CloudFormation template. Create a CloudFormation stack from the template by using the AWS CLI, specifying the --region parameter to deploy the application to other regions

Create a CloudFormation template describing the application infrastructure in the Resources section. Create a CloudFormation stack from the template by using the AWS CLI, specify multiple regions using the --regions parameter to deploy the application

Your answer is correct

Create a CloudFormation template describing the application infrastructure in the Resources section. Use CloudFormation stack set from an administrator account to launch stack instances that deploy the application to various other regions

Overall explanation

Correct option:

Create a CloudFormation template describing the application infrastructure in the Resources section. Use CloudFormation stack set from an administrator account to launch stack instances that deploy the application to various other regions

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-howdoesitwork.html

Here are the relevant CloudFormation concepts:

Template: A CloudFormation template is a JSON or YAML formatted text file. You can save these files with any extension, such as .json, .yaml, .template, or .txt. CloudFormation uses these templates as blueprints for building your AWS resources.

Stack: When you use CloudFormation, you manage related resources as a single unit called a stack. You create, update, and delete a collection of resources by creating, updating, and deleting stacks. All the resources in a stack are defined by the stack's CloudFormation template.

Change set: If you need to make changes to the running resources in a stack, you update the stack. Before making changes to your resources, you can generate a change set, which is a summary of your proposed changes. Change sets allow you to see how your changes might impact your running resources, especially for critical resources, before implementing them.

Stack set: A stack set lets you create stacks in AWS accounts across regions by using a single CloudFormation template. All the resources included in each stack are defined by the stack set's CloudFormation template. As you create the stack set, you specify the template to use, in addition to any parameters and capabilities that the template requires.

After you've defined a stack set, you can create, update, or delete stacks in the target accounts and AWS Regions you specify. When you create, update, or delete stacks, you can also specify operation preferences, such as the order of Regions in which you want the operation to be performed, the failure tolerance beyond which stack operations stop, and the number of accounts in which operations are performed on stacks concurrently. A stack set is a regional resource. If you create a stack set in one AWS Region, you can't see it or change it in other Regions.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html

For the given use case, you need to create a stack set that includes the CloudFormation template that you want to use to create stacks and then identify the AWS Regions in which you want to deploy stacks in your target accounts. A stack set ensures consistent deployment of the same stack resources, with the same settings, to all specified target accounts within the Regions you choose.

Incorrect options:

Create a CloudFormation template describing the application infrastructure in the Resources section. Create a CloudFormation stack from the template by using the AWS CLI, specify multiple regions using the --regions parameter to deploy the application - You can create a stack using the AWS Management Console or using AWS CloudFormation commands in the AWS CLI. The aws cloudformation create-stack command supports only a region parameter for a single region and not regions parameter for multiple regions.

via - https://aws.amazon.com/blogs/infrastructure-and-automation/multiple-account-multiple-region-aws-cloudformation/

Create a shell script that uses the AWS CLI to query the current state in one region and output an AWS CloudFormation template. Create a CloudFormation stack from the template by using the AWS CLI, specifying the --region parameter to deploy the application to other regions - Creating a script is not an elegant solution to provision same infrastructure in multiple AWS regions since this functionality is directly offered by AWS in the form of stack sets.

Create a CloudFormation template describing the application infrastructure in the Resources section. Use CloudFormation change set from an administrator account to launch stack instances that deploy the application to various other regions - When you need to update a stack, understanding how your changes will affect running resources before you implement them can help you update stacks with confidence. Change sets allow you to preview how proposed changes to a stack might impact your running resources, for example, whether your changes will delete or replace any critical resources, AWS CloudFormation makes the changes to your stack only when you decide to execute the change set, allowing you to decide whether to proceed with your proposed changes or explore other changes by creating another change set. You cannot use change sets to deploy an application to multiple AWS regions.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-howdoesitwork.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html

Domain

Design Solutions for Organizational Complexity

Question 5Correct

An e-commerce company is migrating from its on-premises data center to AWS Cloud in a phased manner. As part of the test deployments, the company chose Amazon FSx for Windows File Server with Single-AZ 2 deployment as one of the solutions. After viability testing, it became apparent that the company will need a highly available and fault-tolerant shared Windows file data system to cater to its data storage requirements.

As a solutions architect, what changes will you suggest in the current configuration to make it highly available while keeping the downtime low?

Set up a new Amazon FSx file system with a deployment type of Multi-AZ. Leverage AWS Database Migration Service (DMS) to transfer data to the new Amazon FSx file system. Point users to the new location

Replicate the existing architecture and create another Single-AZ 2 deployment Amazon FSx for Windows File Server. Configure AWS DataSync to continuously back up data from the old file system to the new one. Use the second system as a failover option

Your answer is correct

Set up a new Amazon FSx file system with a Multi-AZ deployment type. Leverage AWS DataSync to transfer data from the old file system to the new one. Point the application to the new Multi-AZ file system

Shut down the existing FSx file system and change the configuration to Multi-AZ through AWS CLI. Restart the file system which will now be a Multi-AZ deployment

Overall explanation

Correct option:

Set up a new Amazon FSx file system with a Multi-AZ deployment type. Leverage AWS DataSync to transfer data from the old file system to the new one. Point the application to the new Multi-AZ file system

via - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/high-availability-multiAZ.html

Multi-AZ file systems support all the availability and durability features of Single-AZ file systems. In addition, they are designed to provide continuous availability of data, even when an Availability Zone is unavailable. In a Multi-AZ deployment, Amazon FSx automatically provisions and maintains a standby file server in a different Availability Zone. Any changes written to disk in your file system are synchronously replicated across Availability Zones to the standby. With Amazon FSx Multi-AZ deployments can enhance availability during planned system maintenance, and help protect your data against instance failure and Availability Zone disruption. If there is planned file system maintenance or unplanned service disruption, Amazon FSx automatically fails over to the secondary file server, allowing you to continue accessing your data without manual intervention.

AWS recommends using AWS DataSync to transfer data between FSx for Windows File Server file systems. DataSync is a data transfer service that simplifies, automates, and accelerates moving and replicating data between on-premises storage systems and other AWS storage services over the internet or AWS Direct Connect. DataSync can transfer your file system data and metadata, such as ownership, timestamps, and access permissions.

DataSync supports copying NTFS access control lists (ACLs), and also supports copying file audit control information, also known as NTFS system access control lists (SACLs), which are used by administrators to control audit logging of user attempts to access files.

You can also use DataSync to transfer files between two FSx for Windows File Server file systems, including file systems in different AWS Regions and file systems owned by different AWS accounts. You can also use DataSync with FSx for Windows File Server file systems for other tasks. For example, you can perform one-time data migrations, periodically ingest data for distributed workloads, and schedule replication for data protection and recovery.

In AWS DataSync, a location for FSx for Windows File Server is an endpoint for an FSx for Windows File Server. You can transfer files between a location for FSx for Windows File Server and a location for other file systems.

How DataSync works with FSx:

via - https://aws.amazon.com/datasync/

Incorrect options:

Shut down the existing FSx file system and change the configuration to Multi-AZ through AWS CLI. Restart the file system which will now be a Multi-AZ deployment - It is not possible to change the deployment type once the FSx file system is created.

Replicate the existing architecture and create another Single-AZ deployment Amazon FSx for Windows File Server. Configure AWS DataSync to continuously back up data from the old file system to the new one. Use the second system as a failover option - With Single-AZ file systems, Amazon FSx automatically replicates your data within an Availability Zone (AZ) to protect it from component failure. It continuously monitors for hardware failures and automatically replaces infrastructure components in the event of a failure. Amazon FSx also uses the Windows Volume Shadow Copy Service to make highly durable backups of your file system daily and store them in Amazon S3. You can make additional backups at any point. Single-AZ 2 is the latest generation of Single-AZ file systems, and it supports both SSD and HDD storage. Single-AZ 1 file systems support SSD storage, Microsoft Distributed File System Replication (DFSR), and the use of custom DNS names.

Creating two Single-AZ deployments does not equate to a Multi-AZ deployment and hence this option is incorrect.

Set up a new Amazon FSx file system with a deployment type of Multi-AZ. Leverage AWS Database Migration Service (DMS) to transfer data to the new Amazon FSx file system. Point users to the new location - AWS Database Migration Service (AWS DMS) helps you migrate databases to AWS quickly and securely. The source database remains fully operational during the migration, minimizing downtime to applications that rely on the database. AWS recommends using AWS DataSync to transfer data between FSx for Windows File Server file systems. DMS does not support FSx as a source type.

References:

https://docs.aws.amazon.com/fsx/latest/WindowsGuide/high-availability-multiAZ.html

https://docs.aws.amazon.com/fsx/latest/WindowsGuide/migrate-files-to-fsx-datasync.html

Domain

Accelerate Workload Migration and Modernization

Question 6Correct

A weather monitoring agency stores and manages the global weather data for the last 50 years. The data has a velocity of 1GB per minute. You would like to store the data with only the most relevant attributes to build a predictive model for weather patterns.

Which of the following solutions would you use to build the most cost-effective solution with the LEAST amount of infrastructure maintenance?

Your answer is correct

Capture the data in Kinesis Data Firehose and use an intermediary Lambda function to filter and transform the incoming stream before the output is dumped on S3

Capture the data in Kinesis Data Streams and use an intermediary Lambda function to filter and transform the incoming stream before the output is dumped on S3

Capture the data in Kinesis Data Analytics and use SQL queries to filter and transform the data before writing to S3

Capture the data in a Spark Streaming Cluster on EMR use Spark Streaming transformations before writing to S3

Overall explanation

Correct option:

Capture the data in Kinesis Data Firehose and use an intermediary Lambda function to filter and transform the incoming stream before the output is dumped on S3

Amazon Kinesis Data Firehose is the easiest way to load streaming data into data stores and analytics tools. It can capture, transform, and load streaming data into Amazon S3, Amazon Redshift, Amazon Elasticsearch Service, and Splunk, enabling near real-time analytics with existing business intelligence tools and dashboards you’re already using today. It is a fully managed service that automatically scales to match the throughput of your data and requires no ongoing administration. It can also batch, compress, and encrypt the data before loading it, minimizing the amount of storage used at the destination and increasing security.

Kinesis Data Firehose Overview

via - https://aws.amazon.com/kinesis/data-firehose/

The correct option is to ingest the data in Kinesis Data Firehose and use a Lambda function to filter and transform the incoming data before the output is dumped on S3. This way you only need to store a sliced version of the data with only the relevant data attributes required for your model. Also, it should be noted that this solution is entirely serverless and requires no infrastructure maintenance.

Kinesis Data Firehose to S3:

via - https://docs.aws.amazon.com/firehose/latest/dev/what-is-this-service.html

Incorrect options:

Capture the data in Kinesis Data Analytics and use SQL queries to filter and transform the data before writing to S3 - Amazon Kinesis Data Analytics is the easiest way to analyze streaming data in real-time. Kinesis Data Analytics enables you to easily and quickly build queries and sophisticated streaming applications in three simple steps: set up your streaming data sources, write your queries or streaming applications and set up your destination for processed data. Kinesis Data Analytics cannot directly ingest data from the source as it ingests data either from Kinesis Data Streams or Kinesis Data Firehose, so this option is ruled out.

Capture the data in Kinesis Data Streams and use an intermediary Lambda function to filter and transform the incoming stream before the output is dumped on S3 - Amazon Kinesis Data Streams (KDS) is a massively scalable, highly durable data ingestion and processing service optimized for streaming data. Amazon Kinesis Data Streams is integrated with many AWS services, including Amazon Kinesis Data Firehose for near real-time transformation.

Kinesis Data Streams cannot directly write the output to S3. In addition, KDS does not offer plug-and-play integration with an intermediary Lambda function as Firehose does. You will need to do a lot of custom coding to get the Lambda function to process the incoming stream and then reliably dump the transformed output to S3. So this option is incorrect.

Capture the data in a Spark Streaming Cluster on EMR use Spark Streaming transformations before writing to S3 - Amazon EMR is the industry-leading cloud big data platform for processing vast amounts of data using open source tools such as Apache Spark, Apache Hive, Apache HBase, Apache Flink, Apache Hudi, and Presto. Amazon EMR uses Hadoop, an open-source framework, to distribute your data and processing across a resizable cluster of Amazon EC2 instances. Using an EMR cluster would imply managing the underlying infrastructure so it’s ruled out because the correct solution for the given use case should require the least amount of infrastructure maintenance.

References:

https://aws.amazon.com/kinesis/data-firehose/

https://docs.aws.amazon.com/firehose/latest/dev/what-is-this-service.html

Domain

Continuous Improvement for Existing Solutions

Question 7Correct

A development team is designing a system on AWS that will leverage Amazon CloudFront for content caching and for protecting the underlying origin. The team has flagged a concern regarding a probable attack on the origin server IP addresses, despite it being served by CloudFront.

As an AWS Certified Solutions Architect Professional, which of the following would you recommend as the BEST solution for providing the strongest level of protection to the origin server?

Configure Origin Access Identity(OAI) on the origin server, which will only allow requests originating from CloudFront

Configure private access to content by using special CloudFront signed URLs or signed cookies

Configure an AWS Lambda@Edge function to validate that the traffic to the Application Load Balancer originates from CloudFront

Your answer is correct

Configure CloudFront to use a custom header and configure an AWS WAF rule on the origin’s Application Load Balancer to accept only traffic that contains that header

Overall explanation

Correct option:

Configure CloudFront to use a custom header and configure an AWS WAF rule on the origin’s Application Load Balancer to accept only traffic that contains that header - You can configure CloudFront to add custom headers to the requests that it sends to your origin. These custom headers enable you to send and gather information from your origin that you don’t get with typical viewer requests. These headers can even be customized for each origin. CloudFront supports custom headers for both custom and Amazon S3 origins.

You can use custom headers for a variety of things, such as the following: 1. Determining which requests come from a particular distribution - If you configure more than one CloudFront distribution to use the same origin, you can add different custom headers in each distribution. You can then use the logs from your origin to determine which requests came from which CloudFront distribution. 2. Enabling cross-origin resource sharing (CORS) 3. Controlling access to content

Incorrect options:

Configure Origin Access Identity(OAI) on the origin server, which will only allow requests originating from CloudFront - Using Origin Access Identity (OAI), access can be restricted to an Amazon S3 bucket, making it only accessible from CloudFront. OAI cannot be used for custom origins.

Configure an AWS Lambda@Edge function to validate that the traffic to the Application Load Balancer originates from CloudFront - Since AWS Lambda@Edge resides on the AWS backbone, it will not be able to validate traffic for the downstream application server such as for an EC2 instance or an Application Load Balancer.

Configure private access to content by using special CloudFront signed URLs or signed cookies - You can configure CloudFront to require that users access your files using either signed URLs or signed cookies. You then develop your application either to create and distribute signed URLs to authenticated users or to send Set-Cookie headers that set signed cookies for authenticated users. You cannot use signed URLs or signed cookies for the given use case.

Reference:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html

Domain

Design for New Solutions

Question 8Correct

An on-premises data center, set up a decade ago, hosts all the applications of a business. The business now wants to move to AWS Cloud. The documentation of these systems is outdated and complete knowledge of all existing workloads is absent. The data center hosts a mix of Windows and Linux virtual machines.

As a solutions architect, you need to provide a plan to migrate all the applications to the cloud. How will you gather the necessary data of the existing machines?

Use the AWS Migration Portfolio Assessment (MPA) tool to connect to each of the VMs to collect the configuration and utilization data

Deploy the AWS Server Migration Service (AWS SMS) connector using the OVA image on the VMware cluster to collect configuration and utilization data from the VMs

Register the on-premises VMs with the AWS Migration Hub to collect configuration and utilization data

Your answer is correct

Install the AWS Application Discovery Service on each of the VMs to collect the configuration and utilization data

Overall explanation

Correct option:

Install the AWS Application Discovery Service on each of the VMs to collect the configuration and utilization data - AWS Application Discovery Service helps enterprise customers plan migration projects by gathering information about their on-premises data centers. ADS will discover on-premises or other hosted infrastructure. This includes details such as server hostnames, IP and MAC addresses, resource allocation, and utilization details of key resources.

Planning data center migrations can involve thousands of workloads that are often deeply interdependent. Server utilization data and dependency mapping are important early first steps in the migration process. AWS Application Discovery Service collects and presents configuration, usage, and behavior data from your servers to help you better understand your workloads.

ADS will identify server dependencies by recording inbound and outbound network activity for each server. ADS will provide details on server performance. It captures performance information about applications and processes by measuring metrics such as host CPU, memory, and disk utilization. It also will allow you to search in Amazon Athena with predefined queries.

The collected data is retained in encrypted format in an AWS Application Discovery Service data store. In addition, this data is also available in AWS Migration Hub, where you can migrate the discovered servers and track their progress as they get migrated to AWS.

All about portfolio assessment and migration planning:

via - https://aws.amazon.com/blogs/architecture/accelerating-your-migration-to-aws/

Incorrect options:

Deploy the AWS Server Migration Service (AWS SMS) connector using the OVA image on the VMware cluster to collect configuration and utilization data from the VMs - AWS SMS combines data collection tools with automated server replication to speed the migration of on-premises servers to AWS. AWS SMS is an agentless service, which makes it easier and faster for you to migrate thousands of on-premises workloads to AWS.

As of March 31, 2022, AWS has discontinued AWS Server Migration Service (AWS SMS). Going forward, AWS recommends AWS Application Migration Service (AWS MGN) as the primary migration service for lift-and-shift migrations.

Use the AWS Migration Portfolio Assessment (MPA) tool to connect to each of the VMs to collect the configuration and utilization data - AWS MPA is a detailed portfolio assessment (server right-sizing, pricing, TCO comparisons, migration cost analysis), as well as migration planning (application data analysis and data collection, application grouping, migration prioritization, and wave planning), can be done online using Migration Portfolio Assessment. MPA offers extensive configuration support and enables experienced consultants to model customers’ scenarios and generate data for business case analysis and migration planning. MPA cannot collect and present configuration, usage, and behavior data from your servers to help you better understand your workloads.

Register the on-premises VMs with the AWS Migration Hub to collect configuration and utilization data - AWS Migration Hub provides a single location to track migration tasks across multiple AWS tools and partner solutions. With Migration Hub, you can choose the AWS and partner migration tools that best fit your needs while gaining visibility into the status of your migration projects. Migration Hub also provides key metrics and progress information for individual applications, regardless of which tools you use to migrate them. Migration Hub cannot collect and present configuration, usage, and behavior data from your servers to help you better understand your workloads.

Reference:

https://aws.amazon.com/blogs/architecture/accelerating-your-migration-to-aws/

Domain

Accelerate Workload Migration and Modernization

Question 9Correct

A research agency processes multiple compressed (gzip) CSV files containing data about contagious diseases for the past month aggregated from healthcare facilities. The files are about ~200 GB and are stored in Amazon S3 Glacier Flexible Storage Class. As per the reporting guidelines, the agency needs to query a portion of this data to prepare a report every month.

Which of the following is the most cost-effective way to query this data?

Your answer is correct

Ingest the data into Amazon S3 from S3 Glacier and query the required data with Amazon S3 Select

Leverage Amazon Glacier Select to query data from S3 Glacier directly

Ingest the data into Amazon S3 and query it with Amazon Redshift Spectrum

Ingest the data into Amazon S3 from S3 Glacier and query the required data with Amazon Athena

Overall explanation

Correct option:

Ingest the data into Amazon S3 from S3 Glacier and query the required data with Amazon S3 Select - S3 Select is an Amazon S3 feature that makes it easy to retrieve specific data from the contents of an object using simple SQL expressions without having to retrieve the entire object. S3 Select simplifies and improves the performance of scanning and filtering the contents of objects into a smaller, targeted dataset by up to 400%. With S3 Select, you can also perform operational investigations on log files in Amazon S3 without the need to operate or manage a compute cluster.

You can use S3 Select to retrieve a subset of data using SQL clauses, like SELECT and WHERE, from objects stored in CSV, JSON, or Apache Parquet format. It also works with objects that are compressed with GZIP or BZIP2 (for CSV and JSON objects only) and server-side encrypted objects.

You can use S3 Select with AWS Lambda to build serverless applications that use S3 Select to efficiently and easily retrieve data from Amazon S3 instead of retrieving and processing entire objects. You can also use S3 Select with Big Data frameworks, such as Presto, Apache Hive, and Apache Spark to scan and filter the data in Amazon S3.

via - https://aws.amazon.com/blogs/aws/s3-glacier-select/

Incorrect options:

Leverage Amazon Glacier Select to query data from S3 Glacier directly - Using S3 Glacier Select, you can use SQL commands to query S3 Glacier archive objects that are in the uncompressed CSV format. With this restriction, you can perform simple query operations only on your text-based data in S3 Glacier. Glacier Select cannot be used on compressed data.

Ingest the data into Amazon S3 and query it with Amazon Redshift Spectrum - Using Amazon Redshift Spectrum, you can efficiently query and retrieve structured and semistructured data from files in Amazon S3 without having to load the data into Amazon Redshift tables. Redshift Spectrum queries employ massive parallelism to run very fast against large datasets. This is a doable solution but is not cost-effective because of the costs involved for Redshift.

Ingest the data into Amazon S3 from S3 Glacier and query the required data with Amazon Athena - Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL queries. Athena is serverless, so there is no infrastructure to set up or manage, and you can start analyzing data immediately. You don’t even need to load your data into Athena, it works directly with data stored in any S3 storage class. Though viable, this option is costlier than S3 Select.

References:

https://docs.aws.amazon.com/amazonglacier/latest/dev/glacier-select.html

https://aws.amazon.com/blogs/storage/querying-data-without-servers-or-databases-using-amazon-s3-select/

https://docs.aws.amazon.com/amazonglacier/latest/dev/glacier-select.html

https://aws.amazon.com/blogs/aws/s3-glacier-select/

Domain

Accelerate Workload Migration and Modernization

Question 10Correct

A company is building an on-demand streaming application on AWS Cloud. The company has chosen Amazon S3 as its storage service and moved the existing videos to an Amazon S3 bucket. The application requires the video playback to start quickly, fast-forwarding should be more efficient and the overall user experience should be smoother without smothering the user's bandwidth.

Which AWS service(s) will help implement this solution effectively?

Deploy the application on Amazon EC2 instances with access to the S3 bucket. Configure these with a Network Load Balancer (NLB). Deploy the application stack in multiple AWS Regions around the world and configure Global Accelerator to serve content to the user

Use AWS Elemental MediaConvert for file-based video processing, and Amazon CloudFront for delivery. Create a CloudFront distribution that points to the S3 bucket with videos uploaded. CloudFront will direct the request to the best edge location, based on the user’s location enhancing the overall user experience

Your answer is correct

Use AWS Elemental MediaConvert for file-based video processing and Amazon CloudFront for delivery. Use video streaming protocols like Apple’s HTTP Live Streaming (HLS) and create a manifest file. Point the CloudFront distribution at the manifest

Use Amazon S3 for storage and Amazon CloudFront for delivery. Use video streaming protocols like Apple’s HTTP Live Streaming (HLS) and create a manifest file. Point the CloudFront distribution at the manifest

Overall explanation

Correct option:

Use AWS Elemental MediaConvert for file-based video processing, and Amazon CloudFront for delivery. Use video streaming protocols like Apple’s HTTP Live Streaming (HLS) and create a manifest file. Point the CloudFront distribution at the manifest

A complete on-demand streaming solution typically makes use of Amazon S3 for storage, AWS Elemental MediaConvert for file-based video processing, and Amazon CloudFront for delivery.

Once videos are uploaded to the Amazon S3 bucket, you may need to convert your video into the size, resolution, or format needed by a particular television or connected device. AWS Elemental MediaConvert will take care of this for you. MediaConvert takes content from S3, transcodes it per your request, and stores the result back in S3. Transcoding processes video files, creating compressed versions of the original content to reduce its size, change its format, or increase playback device compatibility.

With your content safely stored and available in the formats required by your users, the next step is global delivery with Amazon CloudFront. The Amazon Content Delivery Network caches content at the edges for low latency and high throughput video delivery. Its scalability means that you can serve up as much or as little video as you want.

A family of video streaming protocols including Apple’s HTTP Live Streaming (HLS), Dynamic Adaptive Streaming over HTTP (DASH), Microsoft’s Smooth Streaming (MSS), and Adobe’s HTTP Dynamic Streaming (HDS) improves the user experience by delivering video as it is being watched, generally fetching content a few seconds ahead of when it will be needed. Playback starts more quickly, fast-forwarding is more efficient, and the overall user experience is smoother. With this option, you only pay for what the viewer watches, you don’t waste the user’s bandwidth, and users get to see the desired content more quickly.

You will need to do a little more work to implement the second option. First, you use MediaConvert to convert your video files to HLS format (the most widely supported streaming protocol). This will split the video into short segments and will also create a manifest file. Then, you point the CloudFront distribution at the manifest. Finally, to play the live stream, embed the manifest URL in the players that your users will play your live stream with. For example, to play a live stream for which the manifest file is myStream/playlist.m3u8 and the CloudFront distribution is d111111abcdef8.cloudfront.net, you embed the following URL in players: http://d111111abcdef8.cloudfront.net/myStream/playlist.m3u8

On-demand streaming of content stored in Amazon S3:

via - https://aws.amazon.com/cloudfront/streaming/

Incorrect options:

Use AWS Elemental MediaConvert for file-based video processing, and Amazon CloudFront for delivery. Create a CloudFront distribution that points to the S3 bucket with videos uploaded. CloudFront will direct the request to the best edge location, based on the user’s location enhancing the overall user experience - This option is very easy to implement and is supported by just about every mobile device and desktop. All you need to do is to put your content in an S3 bucket and create a CloudFront distribution that points to the bucket. Your user’s video player will use CloudFront URLs (accessible as part of the distribution) to request the video file. The request will be directed to the best edge location, based on the user’s location. The CDN will serve the video from its cache, fetching it from the S3 bucket if it is not already cached. This option has a couple of downsides. It makes inefficient use of your viewer’s bandwidth. If the user doesn’t bother to watch the entire video, content that would never be seen is still downloaded and you are paying for it.

Use Amazon S3 for storage and Amazon CloudFront for delivery. Use video streaming protocols like Apple’s HTTP Live Streaming (HLS) and create a manifest file. Point the CloudFront distribution at the manifest - For this case, AWS Elemental MediaConvert is required to convert your video into the size, resolution, or format needed by a particular television or connected device. Else this functionality will have to be custom-built.

Deploy the application on Amazon EC2 instances with access to the S3 bucket. Configure these with a Network Load Balancer (NLB). Deploy the application stack in multiple AWS Regions around the world and configure Global Accelerator to serve content to the user - AWS Elemental MediaConvert is required to convert your video into the size, resolution, or format needed by a particular television or connected device. Or this functionality will have to be custom-built. Video streaming protocols improve the user experience by delivering video as it is being watched, generally fetching content a few seconds ahead of when it will be needed. This will enhance the user experience by not hogging the network bandwidth of the user. The option lacks the video processing capabilities of AWS Elemental MediaConvert and the efficient delivery capabilities of CloudFront.

References:

https://aws.amazon.com/blogs/networking-and-content-delivery/how-flowplayer-improved-live-video-ingest-with-aws-global-accelerator/

https://aws.amazon.com/cloudfront/streaming/

Domain

Design for New Solutions

Question 11Correct

A solutions architect at a company is managing the migration of the company's IT infrastructure from its on-premises data center to AWS Cloud. The architect needs to automate VPC creation to enforce the company's network and security standards which mandate that each application is isolated in its own VPC. The solution must also ensure that the CIDR range used in each VPC is unique.

Which of the following options would you recommend to address these requirements?

Deploy the VPC infrastructure using AWS CloudFormation and use the intrinsic function Fn::Cidr to request a unique CIDR range

Deploy the VPC infrastructure using AWS OpsWorks and leverage a custom resource to request a unique CIDR range from an external IP address management (IPAM) service

Your answer is correct

Deploy the VPC infrastructure using AWS CloudFormation and leverage a custom resource to request a unique CIDR range from an external IP address management (IPAM) service

Set up the VPCs using AWS CLI and use the dry-run flag to validate if the requested CIDR range is in use

Overall explanation

Correct option:

Deploy the VPC infrastructure using AWS CloudFormation and leverage a custom resource to request a CIDR range from an external IP address management (IPAM) service

AWS CloudFormation gives you an easy way to model a collection of related AWS and third-party resources, provision them quickly and consistently, and manage them throughout their lifecycles, by treating infrastructure as code. CloudFormation template describes all the AWS resources that you want (like Amazon EC2 instances or Amazon RDS DB instances), and CloudFormation takes care of provisioning and configuring those resources for you. Whenever you create a stack, CloudFormation provisions the resources that are described in your template.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-howdoesitwork.html

IP address management (IPAM) is a core part of planning and managing the assignment and use of IP address space of a network. In order to request available CIDR blocks from IPAM for VPCs, you can use AWS CloudFormation Custom Resources. Custom resources enable you to write custom provisioning logic in templates that AWS CloudFormation runs anytime you create, update (if you changed the custom resource), or delete stacks. For custom resources, you can specify AWS::CloudFormation::CustomResource as the resource type, or you can specify your own resource type name. For example, instead of using AWS::CloudFormation::CustomResource, you can use Custom::MyCustomResourceTypeName.

via - https://ca.nttdata.com/en/blog/tech-blog/achieve-networking-at-scale-with-a-self-service-network-solution

Incorrect options:

Deploy the VPC infrastructure using AWS OpsWorks and leverage a custom resource to request a unique CIDR range from an external IP address management (IPAM) service - AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. Chef and Puppet are automation platforms that allow you to use code to automate the configurations of your servers. OpsWorks lets you use Chef and Puppet to automate how servers are configured, deployed, and managed across your Amazon EC2 instances or on-premises compute environments. You cannot deploy the VPC infrastructure using AWS OpsWorks.

Set up the VPCs using AWS CLI and use the dry-run flag to validate if the requested CIDR range is in use - The dry-run flag checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRun-Operation. Otherwise, it is UnauthorizedOperation. The dry-run flag cannot be used to validate if the requested CIDR range is in use.

Deploy the VPC infrastructure using AWS CloudFormation and use the intrinsic function Fn::Cidr to request a unique CIDR range - The intrinsic function Fn::Cidr returns an array of CIDR address blocks. The number of CIDR blocks returned is dependent on the count parameter. The syntax is like so - !Cidr [ ipBlock, count, cidrBits ]. For example, the YAML code !Cidr [ "192.168.0.0/24", 6, 5 ] creates 6 CIDRs with a subnet mask "/27" inside from a CIDR with a mask of "/24". Fn::Cidr cannot be used to request a unique CIDR range.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-howdoesitwork.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-cidr.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cfn-customresource.html

https://ca.nttdata.com/en/blog/tech-blog/achieve-networking-at-scale-with-a-self-service-network-solution

Domain

Accelerate Workload Migration and Modernization

Question 12Correct

A web application is running on a fleet of Amazon EC2 instances that are configured to operate in an Auto Scaling group (ASG). The instances are fronted by an Elastic Load Balancer (ELB). To enhance the system performance, a new Amazon Machine Image (AMI) was created and the ASG was configured to use the new AMI. However, after the production deployment, users complained of aberrations in the expected application functionality. A cross-check on the ELB has confirmed that all the instances are healthy and running as expected.

As a solutions architect, which option would you suggest to rectify these issues and guarantee that later deployments are successful?

Configure the ASG to use multiple Availability Zones. When an instance becomes unhealthy, the ASG maintains the desired capacity by distributing instances across these Availability Zones. This configuration helps in better application availability and reduces errors cropping from network connectivity issues

Configure the ASG to use Elastic Load Balancing (ELB) health checks in place of EC2 status checks

Configure the ASG to a maximum capacity of 3 times the actual needed size. With this configuration, the ASG will terminate unhealthy instances and launch new ones quickly to maintain an optimum number of instances to meet user requirements

Your answer is correct

Create a new ASG launch configuration that uses the newly created AMI. Double the size of the ASG and allow the new instances to become healthy and then reduce the ASG back to the original size. If the new instances do not work as expected, associate the ASG with the old launch configuration

Overall explanation

Correct option:

Create a new ASG launch configuration that uses the newly created AMI. Double the size of the ASG and allow the new instances to become healthy and then reduce the ASG back to the original size. If the new instances do not work as expected, associate the ASG with the old launch configuration

A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances. When you create a launch configuration, you specify information for the instances. Include the ID of the Amazon Machine Image (AMI), the instance type, a key pair, one or more security groups, and a block device mapping. If you've launched an EC2 instance before, you specified the same information to launch the instance.

You can specify your launch configuration with multiple Auto Scaling groups. However, you can only specify one launch configuration for an Auto Scaling group at a time, and you can't modify a launch configuration after you've created it. To change the launch configuration for an Auto Scaling group, you must create a launch configuration and then update your Auto Scaling group with it.

An Auto Scaling group is associated with one launch configuration at a time, and you can't modify a launch configuration after you've created it. To change the launch configuration for an Auto Scaling group, use an existing launch configuration as the basis for a new launch configuration. Then, update the Auto Scaling group to use the new launch configuration.

After you change the launch configuration for an Auto Scaling group, any new instances are launched using the new configuration options, but existing instances are not affected. To update the existing instances, terminate them so that they are replaced by your Auto Scaling group, or allow auto-scaling to gradually replace older instances with newer instances based on your termination policies. If you did not assign a specific termination policy to the group, Amazon EC2 Auto Scaling uses the default termination policy. It terminates the instances that were launched from the oldest launch template or launch configuration.

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-termination-policies.html

Incorrect options:

Configure the ASG to use Elastic Load Balancing (ELB) health checks in place of EC2 status checks - The default health checks for an Auto Scaling group are EC2 status checks only. To ensure that your Auto Scaling group can determine instance health based on additional load balancer tests, configure the Auto Scaling group to use Elastic Load Balancing (ELB) health checks. However, this change will not address the underlying issues for the given use case.

Configure the ASG to a maximum capacity of 3 times the actual needed size. With this configuration, the ASG will terminate unhealthy instances and launch new ones quickly to maintain an optimum number of instances to meet user requirements - This is false and given only as a distractor.

Configure the ASG to use multiple Availability Zones. When an instance becomes unhealthy, the ASG maintains the desired capacity by distributing instances across these Availability Zones. This configuration helps in better application availability and reduces errors cropping from network connectivity issues - When instances are launched, if you specified multiple Availability Zones, the desired capacity is distributed across these Availability Zones. If a scaling action occurs, Amazon EC2 Auto Scaling automatically maintains balance across all of the Availability Zones that you specify. This option is a distractor and will not address the underlying issues for the given use case.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/change-launch-config.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/LaunchConfiguration.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-group-replacing-instances.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-add-elb-healthcheck.html

Domain

Continuous Improvement for Existing Solutions

Question 13Incorrect

A media company has its users accessing the content from different platforms including mobile, tablet, and desktop. Each platform is customized to provide a different user experience based on various viewing modes. Path-based headers are used to serve the content for different platforms, hosted on different Amazon EC2 instances. An Auto Scaling group (ASG) has also been configured for the EC2 instances to ensure that the solution is highly scalable.

Which of the following combination of services can help minimize the cost while maximizing the performance? (Select two)

Your selection is correct

Amazon CloudFront with Lambda@Edge

Amazon Route 53 with traffic flow policies

Network Load Balancer

Your selection is incorrect

Amazon S3 configured as a static website

Correct selection

Application Load Balancer

Overall explanation

Correct options:

Amazon CloudFront with Lambda@Edge - Lambda@Edge is a feature of Amazon CloudFront that lets you run code closer to users of your application, which improves performance and reduces latency. Lambda@Edge runs your code in response to events generated by the Amazon CloudFront content delivery network (CDN). By combining Lambda@Edge with other AWS services, developers can build dynamic, powerful web applications at the edge that automatically scale up and down—with zero origin infrastructure and administrative effort required for automatic scaling, backups, or data center redundancy.

By using Lambda@Edge to dynamically route requests to different origins based on different viewer characteristics, you can balance the load on your origins, while improving the performance for your users. For example, you can route requests to origins within a home region, based on a viewer's location.

With Lambda@Edge, you don't have to provision or manage infrastructure in multiple locations around the world. You pay only for the compute time you consume - there is no charge when your code is not running.

Intelligently Route Across Origins and Data Centers:

via - https://aws.amazon.com/lambda/edge/

Application Load Balancer - An Application Load Balancer serves as the single point of contact for clients. The load balancer distributes incoming application traffic across multiple targets, such as EC2 instances, in multiple Availability Zones. This increases the availability of your application. You add one or more listeners to your load balancer. ALB offers support for Path conditions. You can configure rules for your listener that forward requests based on the URL in the request. This enables you to structure your application as smaller services, and route requests to the correct service based on the content of the URL.

Incorrect options:

Network Load Balancer - Application Load Balancer works at the Application Layer (Layer 7 of the OSI model, Request level). Network Load Balancer works at the Transport layer (Layer 4 of the OSI model). NLB just forwards requests whereas ALB examines the contents of the HTTP request header to determine where to route the request. So, the application load balancer can perform content-based routing while NLB cannot.

Amazon S3 configured as a static website - It is mentioned in the use case that the application is hosted on an Amazon EC2 instance and that a solution is needed for performance and cost-effectiveness. Hence, using Amazon S3 as a static website is not a correct option.

Amazon Route 53 with traffic flow policies - Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. It is designed to give developers and businesses an extremely reliable and cost-effective way to route end users to Internet applications by translating names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect. Amazon Route 53 is fully compliant with IPv6 as well.

Traffic Flow policy allows an Amazon Web Services customer to define how end-user traffic is routed to application endpoints through a visual interface. Route 53 can route between domains and subdomains but is not useful for path-based traffic flows.

References:

https://aws.amazon.com/lambda/edge/

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

https://aws.amazon.com/premiumsupport/knowledge-center/create-subdomain-route-53/

Domain

Accelerate Workload Migration and Modernization

Question 14Correct

A company runs a three-tier web application hosted on AWS Cloud. A Multi-AZ RDS MySQL server (with one standby) forms the database layer with Amazon ElastiCache forming the cache layer. The top management wants a reporting feature for the sales and marketing activity at the company. As a solutions architect, you have been tasked to build a reporting layer that fetches the information from the database and displays it to the management's dashboards every half an hour.

What is the most optimal solution to meet these requirements with the least impact on the operational performance of the database?

Use AWS Lambda to asynchronously send transaction logs from the primary database to the Amazon S3 bucket. Amazon Athena can be used to query and generate reports from S3

Your answer is correct

Create a new RDS Read Replica from your Multi AZ primary database and generate reports by querying the Read Replica

Multi-AZ maintains a standby replica for disaster recovery. Use Standby to query and generate reports needed for the dashboards

Use the in-memory cache layer of ElastiCache to query data and generate reports from this cache memory

Overall explanation

Correct option:

Create a new RDS Read Replica from your Multi AZ primary database and generate reports by querying the Read Replica

Amazon RDS Read Replicas provide enhanced performance and durability for RDS database (DB) instances. They make it easy to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads. You can create one or more replicas of a given source DB Instance and serve high-volume application read traffic from multiple copies of your data, thereby increasing aggregate read throughput. Read replicas can also be promoted when needed to become standalone DB instances. Read replicas are available in Amazon RDS for MySQL, MariaDB, PostgreSQL, Oracle, and SQL Server as well as Amazon Aurora.

For the MySQL, MariaDB, PostgreSQL, Oracle, and SQL Server database engines, Amazon RDS creates a second DB instance using a snapshot of the source DB instance. It then uses the engines' native asynchronous replication to update the read replica whenever there is a change to the source DB instance. The read replica operates as a DB instance that allows only read-only connections; applications can connect to a read replica just as they would to any DB instance. Amazon RDS replicates all databases in the source DB instance.

You can also promote a read replica if the source DB instance fails, and you can set up a read replica with its own standby instance in different AZ. This functionality complements the synchronous replication, automatic failure detection, and failover provided with Multi-AZ deployments.

For the given use case, you can have the management's dashboard reporting queries to run against the read replica rather than your production DB instance, without impacting the operational performance of the production database.

Amazon RDS Read Replicas:

via - https://aws.amazon.com/rds/features/read-replicas/

via - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html

Incorrect options:

Use AWS Lambda to asynchronously send transaction logs from the primary database to the Amazon S3 bucket. Amazon Athena can be used to query and generate reports from S3 - This requires custom code and a trigger to call the Lambda function which requires considerable development and maintenance effort. This is not an optimal solution.

Multi-AZ maintains a standby replica for disaster recovery. Use Standby to query and generate reports needed for the dashboards - In Multi-AZ with one standby, your standby DB instance is only a passive failover target for high availability and is unavailable to serve any read requests.

via - https://aws.amazon.com/rds/features/multi-az/

Use the in-memory cache layer of ElastiCache to query data and generate reports from this cache memory - Cache memory contains data from the most recent requests and does not have the data for the entire database. So this option is incorrect.

References:

https://aws.amazon.com/rds/features/read-replicas/

https://aws.amazon.com/rds/features/multi-az/

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html

Domain

Design for New Solutions

Question 15Correct

A financial services company is building a hybrid Payment Card Industry Data Security Standard (PCI-DSS) compliant application that runs in the us-east-1 Region as well as on-premises. The application sends access logs from all locations to a single S3 bucket in the us-east-1 Region. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses.

As an AWS Certified Solutions Architect Professional, how would you configure the network to meet these requirements?

Create a public virtual interface to a Direct Connect connection in us-east-1. Leverage an on-premises HTTPS proxy to send traffic to S3 over a Direct Connect connection

Your answer is correct

Create a private virtual interface to a Direct Connect connection in us-east-1. Set up an interface VPC endpoint and configure the on-premises systems to access S3 via this endpoint

Set up an AWS Site-to-Site VPN connection to the company's VPC in us-east-1 and use BGP to advertise routes for S3

Set up a VPN connection to the company's VPC in us-east-1. Create a NAT gateway and configure the on-premises systems to leverage an HTTPS proxy in the VPC to access Amazon S3

Overall explanation

Correct option:

Create a private virtual interface to a Direct Connect connection in us-east-1. Set up an interface VPC endpoint and configure the on-premises systems to access S3 via this endpoint

You can establish access to Amazon S3 from your on-premises network via Direct Connect in the following ways:

Use a public IP address over Direct Connect

Use a private IP address over Direct Connect (with an interface VPC endpoint)

To access S3 using a private IP address over Direct Connect, you can create a private virtual interface for your connection and then create an interface VPC endpoint for S3 in your VPC that is associated with the virtual private gateway. The VGW must connect to a Direct Connect private virtual interface. This interface VPC endpoint resolves to a private IP address even if you enable a VPC endpoint for S3. When you access Amazon S3, you need to use the same DNS name provided under the details of the VPC endpoint.

Incorrect options:

Create a public virtual interface to a Direct Connect connection in us-east-1. Leverage an on-premises HTTPS proxy to send traffic to S3 over a Direct Connect connection - To connect to S3 using a public IP address over Direct Connect, you can create a public virtual interface for your connection. After the BGP is up and running, the Direct Connect router advertises all global public IP prefixes, including S3 prefixes. Traffic heading to S3 is routed through the Direct Connect public virtual interface. The public virtual interface is routed through a private network connection between AWS and your data center or corporate network. Since the given use case prohibits using public IP addresses, so this option is incorrect.

Set up an AWS Site-to-Site VPN connection to the company's VPC in us-east-1 and use BGP to advertise routes for S3 - A VPN connection refers to the connection between your VPC and your own on-premises network. Site-to-Site VPN supports Internet Protocol security (IPsec) VPN connections. VPN connection would establish on-premises connectivity with the VPC. You will still need a VPC endpoint to access S3 from within the VPC. The reference to BGP advertising routes for S3 is a distractor.

Set up a VPN connection to the company's VPC in us-east-1. Create a NAT gateway and configure the on-premises systems to leverage an HTTPS proxy in the VPC to access Amazon S3 - A NAT gateway is a Network Address Translation (NAT) service. You can use a NAT gateway so that instances in a private subnet can connect to services outside your VPC but external services cannot initiate a connection with those instances. You cannot use a NAT gateway with a VPN connection to facilitate access to S3. This option has been added as a distractor.

Reference:

https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-access-direct-connect/

Domain

Design Solutions for Organizational Complexity

Question 16Correct

The development team at a gaming company has been tasked to reduce the in-game latency and jitters. The team wants traffic from its end users to be routed to the AWS Region that is closest to the end users geographically. When maintenance occurs in an AWS Region, traffic must be routed to the next closest AWS Region with no changes to the IP addresses being used as connections by the end-users.

As an AWS Certified Solutions Architect Professional, which solution will you suggest to meet these requirements?

Your answer is correct

Set up AWS Global Accelerator in front of all the AWS Regions

Configure a Route 53 geoproximity routing policy to navigate traffic to the closest AWS Region

Set up a CloudFront distribution in front of all the AWS Regions

Configure a Route 53 latency routing policy to navigate traffic to the closest AWS Region

Overall explanation

Correct option:

Set up AWS Global Accelerator in front of all the AWS Regions

AWS Global Accelerator is a networking service that helps you improve the availability and performance of the applications that you offer to your global users. AWS Global Accelerator is easy to set up, configure, and manage. It provides static IP addresses that provide a fixed entry point to your applications and eliminate the complexity of managing specific IP addresses for different AWS Regions and Availability Zones.

As your application architecture grows, so does the complexity, with longer user-facing IP lists and more nuanced traffic routing logic. AWS Global Accelerator solves this by providing you with two static IPs that are anycast from our globally distributed edge locations, giving you a single entry point to your application, regardless of how many AWS Regions it’s deployed in.

via - https://aws.amazon.com/global-accelerator/

For a gaming use case, AWS Global Accelerator enhances your end users' online experience by routing user traffic via the private AWS global network, reducing in-game latency, jitter, and packet loss.

via - https://aws.amazon.com/global-accelerator/

Incorrect options:

Set up a CloudFront distribution in front of all the AWS Regions - Amazon CloudFront is a web service that gives businesses and web application developers an easy and cost-effective way to distribute content with low latency and high data transfer speeds. Amazon CloudFront employs a global network of edge locations and regional edge caches that cache copies of your content close to your viewers. Amazon CloudFront ensures that end-user requests are served by the closest edge location. CloudFront does not support static IP addresses as entry points to your applications, so this option is incorrect.

via - https://aws.amazon.com/global-accelerator/faqs/

Configure a Route 53 geoproximity routing policy to navigate traffic to the closest AWS Region - Geoproximity routing lets Amazon Route 53 route traffic to your resources based on the geographic location of your users and your resources. You can also optionally choose to route more traffic or less to a given resource by specifying a value, known as a bias. A bias expands or shrinks the size of the geographic region from which traffic is routed to a resource. To use geoproximity routing, you must use Route 53 traffic flow.

Route 53 does not support static IP addresses as entry points to your applications, so this option is incorrect.

Configure a Route 53 latency routing policy to navigate traffic to the closest AWS Region - Latency between hosts on the internet can change over time as a result of changes in network connectivity and routing. Latency-based routing is based on latency measurements performed over a period of time, and the measurements reflect these changes. You should use latency routing policy when you have resources in multiple AWS Regions and you want to route traffic to the Region that provides the best latency with less round-trip time.

Route 53 does not support static IP addresses as entry points to your applications, so this option is incorrect.

References:

https://aws.amazon.com/global-accelerator/

https://aws.amazon.com/global-accelerator/faqs/

Domain

Continuous Improvement for Existing Solutions

Question 17Correct

A legacy web application runs 24/7 and it is currently hosted on an on-premises server with an outdated version of the Operating System (OS). The OS support will end soon and the team wants to expedite migration to an Amazon EC2 instance with an updated version of the OS. The application also references 90 TB of static data in the form of images that need to be moved to AWS.

How should this be accomplished most cost-effectively?

Your answer is correct

Replatform the server to Amazon EC2 while choosing an AMI of your choice to cater to the OS requirements. Use AWS Snowball to transfer the image data to Amazon S3

Use AWS Application Migration Service to migrate the application and all its data to Amazon EC2 instance

Set up the application on AWS Fargate for a serverless solution and use AWS Snowball to transfer the image data to Amazon S3

Use AWS Direct Connect to establish a dedicated connection between on-premises systems and AWS. Transfer data to Amazon S3 using this link. Migrate the application to Amazon EC2 instance

Overall explanation

Correct option:

Replatform the server to Amazon EC2 while choosing an AMI of your choice to cater to the OS requirements. Use AWS Snowball to transfer the image data to Amazon S3

Re-platforming the server to Amazon EC2 instances is the best choice here since the use case speaks about updating the existing operating system. Amazon provides pre-configured AMIs to choose different flavors of OS to cater to each requirement. Also, Amazon EC2 is the least expensive of all options.

Key differences between Rehosting and Replatforming:

via - https://aws.amazon.com/blogs/enterprise-strategy/6-strategies-for-migrating-applications-to-the-cloud/

AWS Snowball, a part of the AWS Snow Family, is an edge computing, data migration, and edge storage device that comes in two options. Snowball Edge Storage Optimized devices provide both block storage and Amazon S3-compatible object storage, and 40 vCPUs. They are well suited for local storage and large-scale data transfer.

Amazon Snowball is a data transport solution that accelerates moving terabytes to petabytes of data into and out of Amazon Web Services services using storage devices designed to be secure for physical transport. Using Snowball helps to eliminate challenges that can be encountered with large-scale data transfers including high network costs, long transfer times, and security concerns.

Snowball is the right data transfer choice if you need to securely and quickly transfer terabytes to many petabytes of data to Amazon Web Services services. Snowball can also be the right choice if you don’t want to make expensive upgrades to your network infrastructure.

Finally, transfer the image data from Snowball to Amazon S3, which is the most cost-effective storage solution offered on AWS, when combined with lifecycle policies to further accelerate cost savings.

Incorrect options:

Use AWS Direct Connect to establish a dedicated connection between on-premises systems and AWS. Transfer data to Amazon S3 using this link. Migrate the application to Amazon EC2 instance - AWS Direct Connect is an overkill for a one-time migration requirement. Also, Direct Connect takes time to provision and is cost-prohibitive for this use case.

Set up the application on AWS Fargate for a serverless solution and use AWS Snowball to transfer the image data to Amazon S3 - AWS Fargate is a serverless compute engine for containers that works with both Amazon Elastic Container Service (ECS) and Amazon Elastic Kubernetes Service (EKS). AWS Fargate makes it easy to focus on building your applications. Using Fargate implies changing the architecture of the solution, so it would need separate development effort along with the associated cost. In addition, Fargate is costlier than hosting on Amazon EC2 instance when the application runs 24/7 - as mentioned in the given use case.

Use AWS Application Migration Service to migrate the application and all its data to Amazon EC2 instance - AWS Application Migration Service (AWS MGN) is the primary migration service recommended to lift and shift your applications to AWS. Customers considering CloudEndure Migration are encouraged to use AWS Application Migration Service for future migrations. For the current use case, we are not only looking for lift and shift but for replatforming too. Hence, this option is incorrect.

References:

https://aws.amazon.com/snowball/

https://aws.amazon.com/application-migration-service/

https://aws.amazon.com/blogs/enterprise-strategy/6-strategies-for-migrating-applications-to-the-cloud/

https://blogs.perficient.com/2021/06/17/aws-cost-analysis-comparing-lambda-ec2-fargate/

Domain

Accelerate Workload Migration and Modernization

Question 18Correct

A company has a web application running on an EC2 instance with a single elastic network interface in a subnet in a VPC. As part of the network re-architecture, the CTO at the company wants the web application to be moved to a different subnet in the same Availability Zone.

Which of the following solutions would you suggest to meet these requirements?

Change the subnet of the EC2 instance to the new subnet via AWS CLI

Your answer is correct

Launch a new instance in the new subnet via an AMI created from the old instance. Direct traffic to this new instance using Route 53 and then terminate the old instance

Change the subnet of the EC2 instance to the new subnet via AWS Management Console

Provision an elastic network interface in the new subnet. Attach this new interface to the existing EC2 instance and detach the old interface

Overall explanation

Correct option:

Launch a new instance in the new subnet via an AMI created from the old instance. Direct traffic to this new instance using Route 53 and then terminate the old instance

You can migrate the instance by creating a new Amazon Machine Image (AMI) from the source instance. An Amazon Machine Image (AMI) provides the information required to launch an instance. Launch a new instance using the new AMI in the desired subnet in the same Availability Zone. Direct traffic to this new instance using Route 53 as the new EC2 instance has a different private IPv4 or public IPv6 IP address. You must update all references to the old IP address in the Route 53 DNS records with the new IP address that is assigned to the new instance. Finally, you can terminate the old instance.

Incorrect options:

Change the subnet of the EC2 instance to the new subnet via AWS Management Console - It's not possible to move an existing instance to another subnet, Availability Zone, or VPC. So this option is incorrect.

Provision an elastic network interface in the new subnet. Attach this new interface to the existing EC2 instance and detach the old interface - An elastic network interface is a logical networking component in a VPC that represents a virtual network card. An ENI can only live within a single subnet. You cannot detach the old interface from the EC2 instance as the given use case states that the EC2 instance just has a single elastic network interface, thereby making it the primary network interface. You cannot detach a primary network interface from an instance.

Change the subnet of the EC2 instance to the new subnet via AWS CLI - It's not possible to move an existing instance to another subnet, Availability Zone, or VPC. So this option is incorrect.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html

https://aws.amazon.com/premiumsupport/knowledge-center/move-ec2-instance/

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

Domain

Continuous Improvement for Existing Solutions

Question 19Correct

A standard three-tier application is hosted on Amazon EC2 instances that are fronted by an Application Load Balancer. The application maintenance team has reported several small-scale malicious attacks on the application. The solutions architect wants to ramp up the security of the application.

Which of the following would you recommend as part of the best practices to scan and mitigate the known vulnerabilities?

Use AWS Key Management Services to encrypt all the traffic between the client and application servers. Configure the application security groups to ensure that only the necessary ports are open

Your answer is correct

Configure the application security groups to ensure that only the necessary ports are open. Use Amazon Inspector to periodically scan the EC2 instances for vulnerabilities

Install AWS Certificate Manager (ACM) SSL/TLS certificate on the EC2 instances to secure traffic moving to and from the application servers

Configure the application security groups to ensure that only the necessary ports are open. Use Amazon Systems Manager to periodically scan the EC2 instances for vulnerabilities

Overall explanation

Correct option:

Configure the application security groups to ensure that only the necessary ports are open. Use Amazon Inspector to periodically scan the EC2 instances for vulnerabilities

When you have Amazon EC2 instances behind an Application Load Balancer, the instances themselves might not need to be publicly accessible. Instead, you could provide users with access to the Application Load Balancer on certain TCP ports and allow only the Application Load Balancer to communicate with the instances. All internet traffic to a security group is implicitly denied unless you create an allow rule to permit the traffic.

For example, if you have a web application that uses Elastic Load Balancing and multiple Amazon EC2 instances, you might decide to create one security group for the Elastic Load Balancing (Elastic Load Balancing security group) and one for the instances (web application server security group). You can then create an allow rule to permit internet traffic to the ELB security group, and another rule to permit traffic from the ELB security group to the web application server security group. This ensures that internet traffic can’t directly communicate with your Amazon EC2 instances, which makes it more difficult for an attacker to learn about and impact your application.

To scan for known vulnerabilities, use Amazon Inspector. Amazon Inspector is an automated vulnerability management service that continually scans Amazon Elastic Compute Cloud (EC2) and container workloads for software vulnerabilities and unintended network exposure.

You can enable Amazon Inspector for your entire organization or an individual account with a few clicks in the AWS Management Console. Once enabled, Amazon Inspector automatically discovers running Amazon EC2 instances and Amazon ECR repositories and immediately starts continually scanning workloads for software vulnerabilities and unintended network exposure.

Incorrect options:

Configure the application security groups to ensure that only the necessary ports are open. Use Amazon Systems Manager to periodically scan the EC2 instances for vulnerabilities - The Amazon Inspector uses the Systems Manager (SSM) agent to collect the software application inventory of the Amazon EC2 instances. Then, Inspector scans this data and identifies software vulnerabilities, a crucial step in vulnerability management. The Systems Manager itself cannot scan the EC2 instances for vulnerabilities.

Use AWS Key Management Service (KMS) to encrypt the traffic between the client and application servers. Configure the application security groups to ensure that only the necessary ports are open - This option is a distractor as KMS cannot be used to encrypt the traffic between the client and application servers. AWS Key Management Service (AWS KMS) lets you create, manage, and control cryptographic keys across your applications. For the given scenario, you can use HTTPS to enable website encryption by running HTTP over the Transport Layer Security (TLS) protocol.

Install AWS Certificate Manager (ACM) SSL/TLS certificate on the EC2 instances to secure traffic moving to and from the application servers - ACM certificates cannot be installed on Amazon EC2 instances. An exception to this is a public ACM certificate that can be installed on Amazon EC2 instances that are connected to a Nitro Enclave. ACM certificates are supported by the following services: Elastic Load Balancing, Amazon CloudFront, Amazon Cognito, AWS Elastic Beanstalk, AWS App Runner, Amazon API Gateway, AWS CloudFormation, AWS Amplify, Amazon OpenSearch Service, and AWS Nitro Enclaves.

References:

https://aws.amazon.com/inspector/

https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/attack-surface-reduction.html

https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html

https://aws.amazon.com/blogs/mt/automate-vulnerability-management-and-remediation-in-aws-using-amazon-inspector-and-aws-systems-manager-part-1/

Domain

Continuous Improvement for Existing Solutions

Question 20Incorrect

A data analytics company leverages Amazon QuickSight (Enterprise Edition) for creating and publishing interactive BI dashboards that can be accessed from any device. For a new requirement, the company must create a private connection from Amazon QuickSight to an Amazon RDS DB instance that's in a private subnet to fetch data for analysis.

Which is the BEST solution for configuring a private connection between QuickSight and Amazon RDS DB instance?

Create a Private Virtual Interface between VPC that hosts Amazon RDS DB instance and QuickSight. Use this connection to privately access necessary data from RDS DB

Correct answer

Create a new private subnet in the same VPC as the Amazon RDS DB instance. Create a new security group with necessary inbound rules for QuickSight in the same VPC. Sign in to QuickSight as a QuickSight admin and create a new QuickSight VPC connection. Create a new dataset from the RDS DB instance

Create a new private subnet in the same VPC as the Amazon RDS DB instance. Create a new network Access Control List (ACL) with necessary inbound rules for QuickSight in the same VPC. Connect from QuickSight using a VPC connector

Your answer is incorrect

Amazon QuickSight Enterprise edition is fully integrated with the Amazon VPC service. Create an ENI in QuickSight that points to the VPC that hosts the RDS DB instance. However, the subnet has to be a private subnet and not a public subnet

Overall explanation

Correct option:

Create a new private subnet in the same VPC as the Amazon RDS DB instance. Create a new security group with necessary inbound rules for QuickSight in the same VPC. Sign in to QuickSight as a QuickSight admin and create a new QuickSight VPC connection. Create a new dataset from the RDS DB instance

Amazon QuickSight Enterprise edition is fully integrated with the Amazon VPC service. A VPC based on this service closely resembles a traditional network that you operate in your own data center. It enables you to secure and isolate traffic between resources. You define and control the network elements to suit your requirements, while still getting the benefit of cloud networking and the scalable infrastructure of AWS.

By creating a VPC connection in QuickSight, you're adding an elastic network interface in your VPC. This network interface allows QuickSight to exchange network traffic with a network instance within your VPC. You can provide all of the standard security controls for this network traffic, as you do with other traffic in your VPC. Route tables, network access control lists (ACLs), subnets, and security groups settings all apply to network traffic to and from QuickSight in the same way that they apply to traffic between other instances in your VPC.

When you register a VPC connection with QuickSight, you can securely connect to data that's available only in your VPC, for example: 1. Data you can reach by IP address 2. Data that isn't available on the public internet 3. Private databases 4. On-premises data

This works if you set up connectivity between the VPC and your on-premises network. For example, you might set up connectivity with AWS Direct Connect, a virtual private network (VPN), or a proxy.

After you connect to the data, you can use it to create data analyses and publish secure data dashboards.

Incorrect options:

Amazon QuickSight Enterprise edition is fully integrated with the Amazon VPC service. Create an ENI in QuickSight that points to the VPC that hosts the RDS DB instance. However, the subnet has to be a private subnet and not a public subnet - When you create a VPC connection in QuickSight, an elastic network interface is added in your VPC. ENI is present on the VPC side and not on the QuickSight side of the connection.

Create a new private subnet in the same VPC as the Amazon RDS DB instance. Create a new network Access Control List (ACL) with necessary inbound rules for QuickSight in the same VPC. Connect from QuickSight using VPC connector - By creating a VPC connection in QuickSight, you're adding an elastic network interface in your VPC. You define a Security Group and not an NACL for an ENI.

Create a Private Virtual Interface between VPC that hosts Amazon RDS DB instance and QuickSight. Use this connection to privately access necessary data from RDS DB - A private virtual interface is used to access an Amazon VPC using private IP addresses. This interface is used by the AWS Direct Connect connection. This option has been added as a distractor.

References:

https://docs.aws.amazon.com/quicksight/latest/user/working-with-aws-vpc.html

https://docs.aws.amazon.com/quicksight/latest/user/vpc-creating-a-connection-in-quicksight.html

https://aws.amazon.com/premiumsupport/knowledge-center/quicksight-redshift-private-connection/

Domain

Design for New Solutions

Question 21Incorrect

During a quarterly audit, it has come to light that employees have not followed the security standards mandated by the company while using the AWS Key Management Service (AWS KMS) keys. The senior management has decided that access to AWS KMS keys should be restricted to only the principals belonging to their AWS Organizations.

How will you implement this requirement?

Your answer is incorrect

The aws:PrincipalOrgID global condition context key can be used to restrict access to an AWS service principal

The aws:PrincipalIsAWSService global condition key can be used with the Principal element in a resource-based policy with AWS KMS. List all the AWS account IDs in the Condition element

Correct answer

The aws:PrincipalOrgID global condition key can be used with the Principal element in a resource-based policy with AWS KMS. You need to specify the Organization ID in the Condition element

The aws:PrincipalOrgID global condition key can be used with the Principal element in a resource-based policy with AWS KMS. List all the AWS account IDs in the Condition element

Overall explanation

Correct option:

The aws:PrincipalOrgID global condition key can be used with the Principal element in a resource-based policy with AWS KMS. You need to specify the Organization ID in the Condition element

The aws:PrincipalOrgID global condition key can be used with the Principal element in a resource-based policy with AWS KMS. Instead of listing all the AWS account IDs in an Organization, you can specify the Organization ID in the Condition element.

Create an AWS KMS key policy to allow all accounts in an AWS Organization to perform AWS KMS actions using the AWS global condition context key aws:PrincipalOrgID. It is a best practice to grant the least privilege permissions with AWS Identity and Access Management (IAM) policies. Specify your AWS Organization ID in the condition element of the statement to make sure that only the principals from the accounts in your Organization can access the AWS KMS key.

aws:PrincipalOrgID - Use this key to compare the identifier of the organization in AWS Organizations to which the requesting principal belongs with the identifier specified in the policy. This global key provides an alternative to listing all the account IDs for all AWS accounts in an organization. You can use this condition key to simplify specifying the Principal element in a resource-based policy. You can specify the organization ID in the condition element. When you add and remove accounts, policies that include the aws:PrincipalOrgID key automatically include the correct accounts and don't require manual updating.

Incorrect options:

The aws:PrincipalOrgID global condition context key can be used to restrict access to an AWS service principal - AWS Organizations help you centrally manage and govern your environment as you grow and scale your AWS resources. The aws:PrincipalOrgID global condition context key can't be used to restrict access to an AWS service principal. AWS services that invoke an API call are made from an internal AWS account that is not part of the AWS Organizations.

The aws:PrincipalOrgID global condition key can be used with the Principal element in a resource-based policy with AWS KMS. List all the AWS account IDs in the Condition element - It is possible to configure the requirement with all the account IDs. But, such a solution is not an elegant solution. Instead of listing all the AWS account IDs in an Organization, you can specify the Organization ID in the Condition element.

The aws:PrincipalIsAWSService global condition key can be used with the Principal element in a resource-based policy with AWS KMS. List all the AWS account IDs in the Condition element - You can use this key to check whether the call to your resource is being made directly by an AWS service principal. For example, AWS CloudTrail uses the service principal cloudtrail.amazonaws.com to write logs to your Amazon S3 bucket. Also, instead of listing all the AWS account IDs in an Organization, you can specify the Organization ID in the Condition element.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalisawsservice

https://aws.amazon.com/premiumsupport/knowledge-center/kms-key-organization-account/

Domain

Design for New Solutions

Question 22Correct

An Amazon Redshift cluster is used to store sensitive information of a business-critical application. The compliance guidelines mandate tracking audit logs of the Redshift cluster. The business needs to store the audit logs securely by encrypting the logs at rest. The logs are to be stored for a year at least and audits need to be conducted on the audit logs every month.

Which of the following is a cost-effective solution that fulfills the requirement of storing the logs securely while having access to the logs for monthly audits?

Your answer is correct

Enable default encryption on the Amazon S3 bucket that uses Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Use Amazon Redshift Spectrum to query the data for monthly audits

Enable encryption on the Amazon S3 bucket that uses Amazon Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS) for audit logging. Use Amazon QuickSight to query the data for monthly audits

Enable encryption on the Amazon S3 bucket that uses Amazon Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS) for audit logging. Use Amazon Redshift Spectrum to query the data for monthly audits

Enable default encryption on the Amazon S3 bucket that uses Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Copy the data into the Amazon Redshift cluster from Amazon S3 when data needs to be queried for monthly audits

Overall explanation

Correct option:

Enable default encryption on the Amazon S3 bucket that uses Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Use Amazon Redshift Spectrum to query the data for monthly audits

Audit logging is not turned on by default in Amazon Redshift. When you turn on logging on your cluster, Amazon Redshift creates and uploads logs to Amazon S3 that capture data from the time audit logging is enabled to the present time. Each logging update is a continuation of the information that was already logged.

Audit logging to Amazon S3 is an optional, manual process. When you enable logging on your cluster, you are enabling logging to Amazon S3 only. Currently, you can only use Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging.

Amazon Redshift Spectrum is a feature of Amazon Redshift that lets you run queries against your data lake in Amazon S3, with no data loading or ETL required. When you issue an SQL query, it goes to the Amazon Redshift endpoint, which generates and optimizes a query plan. Amazon Redshift determines what data is local and what is in Amazon S3, generates a plan to minimize the amount of S3 data that needs to be read, and requests Amazon Redshift Spectrum workers out of a shared resource pool to read and process data from S3.

via - https://aws.amazon.com/blogs/big-data/amazon-redshift-spectrum-extends-data-warehousing-out-to-exabytes-no-loading-required/

Incorrect options:

Enable default encryption on the Amazon S3 bucket that uses Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Copy the data into the Amazon Redshift cluster from Amazon S3 when data needs to be queried for monthly audits - Copying data into the Redshift cluster for enabling monthly audits would turn out to be a costly solution. Using Redshift Spectrum is the right fit for the given scenario.

Enable encryption on the Amazon S3 bucket that uses Amazon Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS) for audit logging. Use Amazon QuickSight to query the data for monthly audits

Enable encryption on the Amazon S3 bucket that uses Amazon Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS) for audit logging. Use Amazon Redshift Spectrum to query the data for monthly audits

Currently, you can only use Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Hence, both these options are incorrect.

References:

https://aws.amazon.com/blogs/big-data/amazon-redshift-spectrum-extends-data-warehousing-out-to-exabytes-no-loading-required/

https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html

https://docs.aws.amazon.com/redshift/latest/dg/c-using-spectrum.html

Domain

Accelerate Workload Migration and Modernization

Question 23Correct

An e-commerce business has recently moved to AWS serverless infrastructure with the help of Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application performs as expected on a normal day. But, during peak periods, when thousands of concurrent requests are submitted, the user requests are initially failing before finally succeeding. The development team examined the logs for each component with a special focus on the Amazon CloudWatch Logs for Lambda. None of the components, services, or applications have logged any errors.

What could be the most probable reason for this failure?

Lambda function might have been configured with memory requirements less than 128MB. This causes throttling of requests at Lambda, resulting in user request failures

Your answer is correct

The throttle limit set on API Gateway is very low. During peak hours, the additional requests are not making their way to Lambda

Lambda is configured to use NAT Gateway to connect to the internet and the NAT Gateway is timing out resulting in throttling of Lambda

DynamoDB is shutting down intermittently because of issues in Auto Scaling configuration

Overall explanation

Correct option:

The throttle limit set on API Gateway is very low. During peak hours, the additional requests are not making their way to Lambda

Amazon API Gateway acts as a proxy to the backend operations that you have configured. Amazon API Gateway will automatically scale to handle the amount of traffic your API receives. Amazon API Gateway does not arbitrarily limit or throttle invocations to your backend operations and all requests that are not intercepted by throttling and caching settings in the Amazon API Gateway console are sent to your backend operations.

Throttling rate limits can be set at the method level. You can edit the throttling limits in your method settings through the Amazon API Gateway APIs or in the Amazon API Gateway console. If requests are throttled at API Gateway, they will not reach the Lambda function at all, which explains why there are no errors in CloudWatch Lambda logs.

Incorrect options:

Lambda function might have been configured with memory requirements less than 128MB. This causes throttling of requests at Lambda, resulting in user request failures

Lambda is configured to use NAT Gateway to connect to the internet and the NAT Gateway is timing out resulting in throttling of Lambda

Both the options involving Lambda are incorrect since Lambda CloudWatch logs do not show any errors. This implies that Lambda is not probably getting invoked for all requests and when it is getting invoked, it is acting correctly.

DynamoDB is shutting down intermittently because of issues in Auto Scaling configuration - If DynamoDB shuts down there will be logs highlighting this activity. It is unlikely that DynamoDB is shutting down and starting up without generating any errors in the logs.

Reference:

https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html

https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-usage-plans-with-console.html#api-gateway-usage-plan-create

Domain

Continuous Improvement for Existing Solutions

Question 24Correct

A company has an S3 bucket that contains files in two different folders - s3://my-bucket/images and s3://my-bucket/thumbnails. When an image is first uploaded and new, it is viewed several times. Post a detailed analysis, the company has noticed that after 45 days those image files are rarely requested, but the thumbnails still are. After 180 days, the company would like to archive the image files and the thumbnails. Overall, the company would like the solution to remain highly available to prevent disasters from happening against a whole AZ.

Which of the following options can be combined to represent the most cost-efficient solution for the given scenario? (Select two)

Configure a Lifecycle Policy to transition all objects to S3 Standard IA after 45 days

Your selection is correct

Configure a Lifecycle Policy to transition objects to S3 Standard IA using a prefix after 45 days

Configure a Lifecycle Policy to transition objects to S3 One Zone IA using a prefix after 45 days

Configure a Lifecycle Policy to transition objects to Glacier using a prefix after 180 days

Your selection is correct

Configure a Lifecycle Policy to transition all objects to Glacier after 180 days

Overall explanation

Correct options:

To manage your S3 objects, so they are stored cost-effectively throughout their lifecycle, configure their Amazon S3 Lifecycle. An S3 Lifecycle configuration is a set of rules that define actions that Amazon S3 applies to a group of objects. There are two types of actions:

Transition actions — Define when objects transition to another storage class. For example, you might choose to transition objects to the S3 Standard-IA storage class 30 days after you created them, or archive objects to the S3 Glacier storage class one year after creating them.

Expiration actions — Define when objects expire. Amazon S3 deletes expired objects on your behalf.

Configure a Lifecycle Policy to transition objects to S3 Standard IA using a prefix after 45 days

S3 Standard-IA is for data that is accessed less frequently but requires rapid access when needed. S3 Standard-IA offers high durability, high throughput, and low latency of S3 Standard, with a low per GB storage price and per GB retrieval fee. This combination of low cost and high performance makes S3 Standard-IA ideal for long-term storage, backups, and as a data store for disaster recovery files. The minimum storage duration charge is 30 days.

As the use-case mentions, after 45 days, image files are rarely requested, but the thumbnails still are. So you need to use a prefix while configuring the Lifecycle Policy so that only objects in the s3://my-bucket/images are transitioned to Standard IA and not all the objects in the bucket.

Configure a Lifecycle Policy to transition all objects to Glacier after 180 days

Amazon S3 Glacier and S3 Glacier Deep Archive are secure, durable, and extremely low-cost Amazon S3 cloud storage classes for data archiving and long-term backup. They are designed to deliver 99.999999999% durability and provide comprehensive security and compliance capabilities that can help meet even the most stringent regulatory requirements.

Incorrect options:

Configure a Lifecycle Policy to transition all objects to S3 Standard IA after 45 days - As discussed above, you need to use a prefix while configuring the Lifecycle Policy so that only objects in the s3://my-bucket/images are transitioned to Standard IA and not all the objects in the bucket.

Configure a Lifecycle Policy to transition objects to Glacier using a prefix after 180 days - After 180 days, you can move all the objects to Glacier storage as per the use case. Glacier doesn't need prefixes for the given use case.

Configure a Lifecycle Policy to transition objects to S3 One Zone IA using a prefix after 45 days - S3 Standard-IA is for data that is accessed less frequently but requires rapid access when needed. S3 Standard-IA offers high durability, high throughput, and low latency of S3 Standard, with a low per GB storage price and per GB retrieval fee. This combination of low cost and high performance makes S3 Standard-IA ideal for long-term storage, backups, and as a data store for disaster recovery files. The minimum storage duration charge is 30 days.

S3 One Zone-IA is for data that is accessed less frequently but requires rapid access when needed. Unlike other S3 Storage Classes which store data in a minimum of three Availability Zones (AZs), S3 One Zone-IA stores data in a single AZ and costs 20% less than S3 Standard-IA. The minimum storage duration charge is 30 days.

Finally, S3 One Zone IA will not offer the required availability in case an AZ goes down.

References:

https://aws.amazon.com/s3/storage-classes/

https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html

Domain

Accelerate Workload Migration and Modernization

Question 25Incorrect

An e-commerce company traditionally hosted its application APIs on Amazon EC2 instances. Recently, the company has started migrating to a serverless architecture that is built using Amazon API Gateway, AWS Lambda functions, and Amazon DynamoDB. The Lambda functions and EC2 instances share the same Virtual Private Cloud (VPC). The Lambda functions hold the logic to fetch data from a third-party service provider.

After moving a portion of functionality to the serverless model, users have started complaining of API Gateway 5XX errors. The third-party service provider is unable to see any requests from the serverless architecture. Upon inspection, the development team can see that the Lambda functions have created some entries in the generated logs.

Which solution would you recommend to troubleshoot this issue?

API Gateway does not have the necessary permissions to invoke Lambda

Your answer is incorrect

Create a request limit increase for API Gateway

Increase the concurrency limit for Lambda function to cater to the high user traffic

Correct answer

NAT Gateway has to be configured to give internet access to the Amazon VPC connected Lambda function

Overall explanation

Correct option:

NAT Gateway has to be configured to give internet access to the Amazon VPC connected Lambda function

The use case mentions that the Lambda functions can generate the log files, thereby indicating that the Lambda functions are getting triggered. But, the third-party service provider is unable to see any requests coming from the Lambda functions, implying that the Lambda functions may have access issues for the service provider functionality. Hence, the most probable reason could be Lambda functions not being able to access the internet because of the faulty configuration.

By default, a Lambda function runs in a secure VPC with access to AWS services and the internet. Lambda owns this VPC, which isn't connected to your account's default VPC. When you connect a function to a VPC in your account, the function can't access the internet unless your VPC provides access.

Internet access from a private subnet requires network address translation (NAT). To give your function access to the internet, route outbound traffic to a NAT gateway in a public subnet. The NAT gateway has a public IP address and can connect to the internet through the VPC's internet gateway.

Complete list of steps for creating NAT Gateway:

via - https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/

Incorrect options:

Create a request limit increase for API Gateway - When request submissions exceed the steady-state request rate and burst limits, API Gateway begins to throttle requests. Clients may receive 429 Too Many Requests error responses at this point. The use case mentions API Gateway error 5XX (execution failed due to a timeout error), so it's not a throttling issue.

via - https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html

via - https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-errors-cloudwatch-logs/

API Gateway does not have the necessary permissions to invoke Lambda - It is mentioned in the use case that the AWS Lambda function is generating log files. This indicates that the Lambda function is getting invoked. So, access from API Gateway to Lambda is not the issue here.

Increase the concurrency limit for Lambda function to cater to the high user traffic - You do not have to scale your Lambda functions, AWS Lambda scales them automatically on your behalf. Every time an event notification is received for your function, AWS Lambda quickly locates free capacity within its compute fleet and runs your code. Since your code is stateless, AWS Lambda can start as many copies of your function as needed without lengthy deployment and configuration delays. AWS Lambda will dynamically allocate capacity to match the rate of incoming events.

References:

https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html

https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/

https://docs.aws.amazon.com/apigateway/latest/developerguide/handle-errors-in-lambda-integration.html

https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html

https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-errors-cloudwatch-logs/

Domain

Accelerate Workload Migration and Modernization

Question 26Correct

A team needs to set up a private network connection between AWS Storage Gateway's file interface (file gateway) and Amazon Simple Storage Service (Amazon S3). The Gateway should not communicate with AWS services over the internet.

Which of the following options can be used to configure this requirement? (Select two)

Create a VPC peering between AWS Storage Gateway's file interface and Amazon S3

Setup a Private virtual interface between the AWS Storage Gateway and Amazon S3

Your selection is correct

Create a VPC Gateway endpoint and create the file gateway using this VPC endpoint

Your selection is correct

Create a VPC Interface endpoint and create the file gateway using this VPC endpoint

Setup a VPC Gateway Load Balancer endpoint and create the file gateway using this VPC endpoint

Overall explanation

Correct options:

Create a VPC Interface endpoint and create the file gateway using this VPC endpoint

Create a VPC Gateway endpoint and create the file gateway using this VPC endpoint

You can set up a private network connection between a file gateway and Amazon S3 within an Amazon Virtual Private Cloud (Amazon VPC) where the gateway appliance connects with service endpoints over an internal private network. To set up this private connection within a VPC, do the following:

Create either a VPC Gateway endpoint or an Interface endpoint for Amazon S3.

Create a file gateway using a VPC endpoint.

Amazon S3 File Gateway supports two Amazon S3 endpoints. However, you need to create only one type of endpoint based on your use case.

A VPC endpoint enables connections between a virtual private cloud (VPC) and the supported services, without requiring that you use an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Therefore, you control the specific API endpoints, sites, and services that are reachable from your VPC.

VPC Interface endpoint: An interface endpoint is an elastic network interface with a private IP address from the IP address range of your subnet. It serves as an entry point for traffic destined to a service that is owned by AWS or owned by an AWS customer or partner.

VPC Gateway endpoint: A Gateway endpoint is a gateway that is a target for a route in your route table used for traffic destined to either Amazon S3 or DynamoDB.

Amazon S3 supports both Gateway endpoints and Interface endpoints.

Difference between Gateway endpoint and Interface endpoint for Amazon S3:

via - https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3

Incorrect options:

Setup a VPC Gateway Load Balancer endpoint and create the file gateway using this VPC endpoint - A Gateway Load Balancer endpoint is an elastic network interface with a private IP address from the IP address range of your subnet. It serves as an entry point to intercept traffic and route it to a network or security service that you've configured using a Gateway Load Balancer. You specify a Gateway Load Balancer endpoint as a target for a route in a route table. Gateway Load Balancer endpoints are supported only for endpoint services that are configured using a Gateway Load Balancer.

Create a VPC peering between AWS Storage Gateway's file interface and Amazon S3 - A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. VPC peering between AWS Storage Gateway's file interface and Amazon S3 is not possible.

Setup a Private virtual interface between the AWS Storage Gateway and Amazon S3 - A Private virtual interface is used only for an AWS Direct Connect connection. A private virtual interface is used to access an Amazon VPC using private IP addresses in AWS Direct Connect.

None of these three connectivity options can be used to set up a private network connection between a file gateway and S3.

References:

https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html

https://aws.amazon.com/premiumsupport/knowledge-center/storage-gateway-file-gateway-private-s3/

Domain

Design for New Solutions

Question 27Correct

An analytics company has configured a hybrid environment between its on-premises data center and the AWS Cloud. The company wants to use the Elastic File System (EFS) to store and share data between the on-premises applications that need to resolve DNS queries through the on-premises DNS servers. The company wants to use a custom domain name to connect to EFS. The company also wants to avoid using the Amazon EFS target IP address.

Which of the following solutions would you recommend to address these requirements?

Your answer is correct

Configure a Route 53 Resolver inbound endpoint and configure it for the EFS specific VPC. Create a Route 53 private hosted zone and add a new CNAME record with the value of the EFS DNS name. Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 private hosted zone

Configure a Route 53 Resolver outbound endpoint and configure it for the EFS specific VPC. Create a Route 53 public-hosted zone and add a new CNAME record with the value of the EFS DNS name. Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 public hosted zone

Configure a Route 53 Resolver inbound endpoint and configure it for the EFS specific VPC. Create a Route 53 public-hosted zone and add a new CNAME record with the value of the EFS DNS name. Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 public hosted zone

Configure a Route 53 Resolver inbound endpoint and configure it for the EFS specific VPC. Create a Route 53 public-hosted zone and add a new PTR record with the value of the EFS DNS name. Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 public hosted zone

Overall explanation

Correct option:

Configure a Route 53 Resolver inbound endpoint and configure it for the EFS specific VPC. Create a Route 53 private hosted zone and add a new CNAME record with the value of the EFS DNS name. Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 private hosted zone

When you create a VPC using Amazon VPC, Route 53 Resolver automatically uses a Resolver on the VPC to answer DNS queries for local Amazon VPC domain names for EC2 instances (ec2-192-0-2-44.compute-1.amazonaws.com) and records in private hosted zones (acme.example.com). For all other domain names, Resolver performs recursive lookups against public name servers.

When you create a VPC, the Route 53 Resolver that is created by default, maps to a DNS server that runs on a reserved IP address for the VPC network range, plus 2. For example, the DNS Server on a 10.0.0.0/16 network is located at 10.0.0.2. For VPCs with multiple IPv4 CIDR blocks, the DNS server IP address is located in the primary CIDR block. The DNS server does not reside within a specific subnet or Availability Zone in a VPC.

The Resolver additionally contains endpoints that you configure to answer DNS queries to and from your on-premises environment. Before you start to forward queries, you create Resolver inbound and/or outbound endpoints in the connected VPC. These endpoints provide a path for inbound or outbound queries.

For the given use case, the company wants to use EFS to store and share data via a custom domain name to connect to Amazon EFS through the on-premises DNS servers. So you need to create a Resolver inbound endpoint so that the DNS resolvers on your network can forward DNS queries to Route 53 Resolver via this endpoint. This allows your DNS resolvers to easily resolve domain names for AWS resources such as EC2 instances or records in a Route 53 private hosted zone.

via - https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html

via - https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html

Incorrect options:

Configure a Route 53 Resolver inbound endpoint and configure it for the EFS specific VPC. Create a Route 53 public-hosted zone and add a new PTR record with the value of the EFS DNS name. Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 public hosted zone - You cannot use a PTR record for the given use case, as it's used to enable reverse DNS functionality for Route 53. A PTR record maps an IP address to the corresponding domain name.

Configure a Route 53 Resolver inbound endpoint and configure it for the EFS specific VPC. Create a Route 53 public-hosted zone and add a new CNAME record with the value of the EFS DNS name. Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 public hosted zone - You cannot use a Route 53 public hosted zone for the given use case as it makes the endpoint public.

Configure a Route 53 Resolver outbound endpoint and configure it for the EFS specific VPC. Create a Route 53 public-hosted zone and add a new CNAME record with the value of the EFS DNS name. Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 public hosted zone - Resolver outbound endpoints are used to forward selected queries, you create Resolver rules that specify the domain names for the DNS queries that you want to forward (such as example.com), and the IP addresses of the DNS resolvers on your network that you want to forward the queries to. For the given use case, the company wants to use EFS to store and share data via a custom domain name to connect to Amazon EFS through the on-premises DNS servers, so you cannot use an outbound endpoint.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html

https://aws.amazon.com/premiumsupport/knowledge-center/route53-resolve-with-inbound-endpoint/

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html

https://aws.amazon.com/premiumsupport/knowledge-center/efs-mount-fqdn-microsoft-ad/

https://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html

Domain

Design Solutions for Organizational Complexity

Question 28Correct

A company has an Elastic Load Balancer (ELB) that is configured with an Auto Scaling Group (ASG) having a minimum of 4, a maximum of 10, and the desired value of 4 instances. The ASG cooldown and the termination policies are configured to the default values. Monitoring reports indicate a general usage requirement of 4 instances, while any traffic spikes result in an additional 10 instances. Customers have been complaining of request timeouts and partially loaded pages.

As an AWS Certified Solutions Architect Professional, which of the following options will you suggest to fix this issue?

Add a lifecycle hook on scale-out event to your ASG, making sure that the instance is fully ready before it starts receiving traffic

Enable Sticky Sessions on ELB

Configure termination policies on ASG to determine which instances it terminates first during scale-in events

Your answer is correct

Configure connection draining on ELB

Overall explanation

Correct option:

Configure connection draining on ELB - To ensure that an ELB stops sending requests to instances that are de-registering or unhealthy while keeping the existing connections open, use connection draining. This enables the load balancer to complete in-flight requests made to instances that are de-registering or unhealthy.

When you enable connection draining, you can specify a maximum time for the load balancer to keep connections alive before reporting the instance as de-registered. The maximum timeout value can be set between 1 and 3,600 seconds (the default is 300 seconds). When the maximum time limit is reached, the load balancer forcibly closes connections to the de-registering instance.

When Connection Draining is enabled and configured, the process of deregistering an instance from an Elastic Load Balancer gains an additional step. For the duration of the configured timeout, the load balancer will allow existing, in-flight requests made to an instance to complete, but it will not send any new requests to the instance.

Incorrect options:

Configure termination policies on ASG to determine which instances it terminates first during scale-in events - Amazon EC2 Auto Scaling uses termination policies to determine which instances it terminates first during scale-in events. Termination policies define the termination criteria that is used by Amazon EC2 Auto Scaling when choosing which instances to terminate. However, termination policies are not relevant to the given use case.

Enable Sticky Sessions on ELB - Sticky session feature (also known as session affinity), enables the load balancer to bind a user's session to a specific instance. This ensures that all requests from the user during the session are sent to the same instance. The key to managing sticky sessions is to determine how long your load balancer should consistently route the user's request to the same instance. A sticky session is relevant for a use case that needs to maintain session functionality.

Add a lifecycle hook on scale-out event to your ASG, making sure that the instance is fully ready before it starts receiving traffic - Amazon EC2 Auto Scaling offers the ability to add lifecycle hooks to your Auto Scaling groups. These hooks enable an Auto Scaling group to be aware of events in the Auto Scaling instance lifecycle and then perform a custom action when the corresponding lifecycle event occurs. Adding a lifecycle hook on a scale-out event is not relevant for the given use case.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-conn-drain.html

https://aws.amazon.com/blogs/aws/elb-connection-draining-remove-instances-from-service-with-care/

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-instance-termination.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/lifecycle-hooks.html

Domain

Continuous Improvement for Existing Solutions

Question 29Correct

A company has many AWS accounts for its different business units. As per the company's policy, developers should have limited access to a few AWS Regions (known as Core Regions). This restricted access was implemented using custom code. The company now wants to use AWS services to implement this restriction and relinquish the custom application.

Which of the following represents the most optimal solution that is easy to set up and maintain?

Set up AWS Single Sign-On and attach the AWS accounts of all business units. Create permission sets with policies to restrict access to Non-Core Regions. Create IAM users and IAM groups in each account

Use Permissions boundaries on IAM users belonging to Non-Core Regions to restrict access to Core Regions. Use an AWS managed policy to create the necessary Permissions boundary

Your answer is correct

Enable AWS Organizations and attach the AWS accounts of all business units to it. Create a Service Control Policy to deny access to the Non-Core Regions and attach the policy to the root OU

Create IAM Groups for users in Core and Non-Core Regions. Attach appropriate IAM policies to implement restrictions on user access belonging to each of these IAM Groups

Overall explanation

Correct option:

Enable AWS Organizations and attach the AWS accounts of all business units to it. Create a Service Control Policy to deny access to the Non-Core Regions and attach the policy to the root OU

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization. SCPs help you to ensure your accounts stay within your organization’s access control guidelines. SCPs are available only in an organization that has all features enabled. SCPs don't affect users or roles in the management account. They affect only the member accounts in your organization.

Using SCPs, it is possible to deny access to AWS resources based on the requested AWS Region.

The attached example policy uses the Deny effect to deny access to all requests for operations that don't target one of the two approved regions (eu-central-1 and eu-west-1). The NotAction element enables you to list services whose operations (or individual operations) are exempted from this restriction. Because global services have endpoints that are physically hosted by the us-east-1 Region , they must be exempted in this way. With an SCP structured this way, requests made to global services in the us-east-1 Region are allowed if the requested service is included in the NotAction element. Any other requests to services in the us-east-1 Region are denied by this example policy.

For the given use case, you can create the Service Control Policy to deny access to the Non-Core Regions and attach the policy to the root OU.

Example policy that denies access to AWS based on the requested AWS Region:

via - https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-deny-region

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyAllOutsideEU",
"Effect": "Deny",
"NotAction": [
"a4b:*",
"acm:*",
"aws-marketplace-management:*",
"aws-marketplace:*",
"aws-portal:*",
"budgets:*",
"ce:*",
"chime:*",
"cloudfront:*",
"config:*",
"cur:*",
"directconnect:*",
"ec2:DescribeRegions",
"ec2:DescribeTransitGateways",
"ec2:DescribeVpnGateways",
"fms:*",
"globalaccelerator:*",
"health:*",
"iam:*",
"importexport:*",
"kms:*",
"mobileanalytics:*",
"networkmanager:*",
"organizations:*",
"pricing:*",
"route53:*",
"route53domains:*",
"s3:GetAccountPublic*",
"s3:ListAllMyBuckets",
"s3:PutAccountPublic*",
"shield:*",
"sts:*",
"support:*",
"trustedadvisor:*",
"waf-regional:*",
"waf:*",
"wafv2:*",
"wellarchitected:*"
],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": [
"eu-central-1",
"eu-west-1"
]
},
"ArnNotLike": {
"aws:PrincipalARN": [
"arn:aws:iam::*:role/Role1AllowedToBypassThisSCP",
"arn:aws:iam::*:role/Role2AllowedToBypassThisSCP"
]
}
}
}
]
}

Incorrect options:

Create IAM Groups for users in Core and Non-Core Regions. Attach appropriate IAM policies to implement restrictions on user access belonging to each of these IAM Groups - Although it is certainly possible to implement the restrictions using IAM policies attached to the given groups, but it requires considerably more administrative overhead to maintain this solution as members need to be added/removed manually depending on their access privilege. It is better to use SCP as it provides an elegant solution at the organization level.

Use Permissions boundaries on IAM users belonging to Non-Core Regions to restrict access to Core Regions. Use an AWS managed policy to create the necessary Permissions boundary - AWS supports permissions boundaries for IAM entities (users or roles). A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. An entity's permissions boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries. Permissions boundaries cannot be used for this use case.

Set up AWS Single Sign-On and attach the AWS accounts of all business units. Create permission sets with policies to restrict access to Non-Core Regions. Create IAM users and IAM groups in each account - AWS Single Sign-On (AWS SSO) is where you create, or connect, your workforce identities in AWS once and manage access centrally across your AWS organization. You can choose to manage access just to your AWS accounts or cloud applications. You can create user identities directly in AWS SSO, or you can bring them from your Microsoft Active Directory or a standards-based identity provider, such as Okta Universal Directory or Azure AD. Here, each user account/group has to be created and managed for restricting the access. Hence, this is not an optimal solution for this use case.

References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-deny-region

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

Domain

Design Solutions for Organizational Complexity

Question 30Correct

An e-commerce business has several AWS accounts. For implementing a new feature, the development team has used AWS Lambda functions which will be managed in a centralized AWS account. The team needs the required permissions to allow the Lambda functions to access resources in each of the company's AWS accounts with the least privilege(s) possible.

How will you configure this requirement? (Select two)

Your selection is correct

In the other AWS accounts, configure an IAM role that has minimal permissions. Add the Lambda execution role of the centralized account as a trusted entity

In the other AWS accounts, configure a service-linked role for the Lambda function of the centralized account. Provide least possible privileges to this role

Your selection is correct

In the centralized account, configure an IAM role that has the Lambda service as a trusted entity. Add an inline policy to assume the roles of the other AWS accounts

In the other AWS accounts, configure an IAM role that has permissions to assume the role of the centralized account. Add the Lambda service as a trusted entity

In the centralized account, configure an IAM role that has roles of the other accounts as trusted entities. Provide least possible privileges to this role

Overall explanation

Correct options:

In the other AWS accounts, configure an IAM role that has minimal permissions. Add the Lambda execution role of the centralized account as a trusted entity

In the centralized account, configure an IAM role that has the Lambda service as a trusted entity. Add an inline policy to assume the roles of the other AWS accounts

Here are some basics on IAM roles. An IAM role has three places where it uses policies:

Permission policies (inline and attached) – These policies define the permissions that a principal assuming the role is able (or restricted) to perform, and on which resources.

Permissions boundary – A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. An entity’s permissions boundary allows it to perform only the actions that are allowed by both its identity-based permission policies and its permissions boundaries.

Trust relationship – This policy defines which principals can assume the role, and under which conditions. This is sometimes referred to as a resource-based policy for the IAM role. This policy is simply referred to as the ‘trust policy’.

How to delegate access across AWS accounts using IAM roles:

via - https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

For the given use case, you can configure the Lambda functions in the centralized account to have their execution role allow the function to assume an IAM role in the other AWS accounts via an inline policy. Then you need to modify your cross-account IAM role's trust policy to allow your Lambda function's execution role to assume the role. A Lambda function can assume an IAM role in another AWS account to do either of the following: Access resources — such as accessing an Amazon Simple Storage Service (Amazon S3) bucket. Do tasks — such as starting and stopping EC2 instances.

Incorrect options:

In the centralized account, configure an IAM role that has roles of the other accounts as trusted entities. Provide least possible privileges to this role

In the other AWS accounts, configure an IAM role that has permissions to assume the role of the centralized account. Add the Lambda service as a trusted entity

These two options contradict the explanation provided above, so these options are incorrect.

In the other AWS accounts, configure a service-linked role for the Lambda function of the centralized account. Provide least possible privileges to this role - AWS Lambda doesn't have service-linked roles, so this option has been added as a distractor.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/

Domain

Design Solutions for Organizational Complexity

Question 31Correct

A company has various business units, each holding its AWS account. With a growing number of different AWS accounts, the company has decided to use AWS Organizations to centralize permissions and access controls. As a solutions architect, you have been asked to define Service Control Policies (SCPs) for the company.

Which of the following represent true statements about SCPs? (Select two)

Your selection is correct

The specified actions from an attached SCP affect all IAM identities including the root user of the member account

If both a permissions boundary and an SCP are present, then the boundary and the identity-based policy must all allow the action. Permissions boundary overwrites the SCP in such a scenario

The SCP denies access to all Amazon EC2 instances. The service-linked roles of the member accounts will not be able to access the EC2 instances with these existing roles

An Amazon S3 bucket is owned by account A in an organization. The bucket policy (a resource-based policy) grants access to users from account B outside the organization. Account A has an SCP attached. By the flow of hierarchy, account B will now have SCP attached to it

Your selection is correct

If a user has an IAM policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user cannot perform that action

Overall explanation

Correct options:

If a user has an IAM policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user cannot perform that action - AWS services that aren't explicitly allowed by the SCPs associated with an AWS account or its parent OUs are denied access to the AWS accounts or OUs associated with the SCP. SCPs associated with an OU are inherited by all AWS accounts in that OU.

The specified actions from an attached SCP affect all IAM identities including the root user of the member account - You can use SCPs to allow or deny access to AWS services for individual AWS accounts with AWS Organization's member accounts, or for groups of accounts within an organizational unit (OU). The specified actions from an attached SCP affect all IAM identities including the root user of the member account. SCPs affect only member accounts in the organization. They do not affect users or roles in the management account.

Service Control Policies (SCPs):

via - https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

Incorrect options:

The SCP denies access to all Amazon EC2 instances. The service-linked roles of the member accounts will not be able to access the EC2 instances with these existing roles - SCPs do not affect any service-linked role. service-linked roles enable other AWS services to integrate with AWS Organizations and can't be restricted by SCPs.

An Amazon S3 bucket is owned by account A in an organization. The bucket policy (a resource-based policy) grants access to users from account B outside the organization. Account A has an SCP attached. By the flow of hierarchy, account B will now have SCP attached to it - SCPs affect only IAM users and roles that are managed by accounts that are part of the organization. SCPs don't affect resource-based policies directly. They also don't affect users or roles from accounts outside the organization. For example, consider an Amazon S3 bucket that's owned by account A in an organization. The bucket policy (a resource-based policy) grants access to users from account B outside the organization. Account A has an SCP attached. That SCP doesn't apply to those outside users in account B. The SCP applies only to users that are managed by account A in the organization.

If both a permissions boundary and an SCP are present, then the boundary and the identity-based policy must all allow the action. Permissions boundary overwrites the SCP in such a scenario - If both a permissions boundary (an advanced IAM feature) and an SCP are present, then the boundary, the SCP, and the identity-based policy must all allow the action.

via - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_auth.html

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

Domain

Design Solutions for Organizational Complexity

Question 32Correct

A mobile app with video upload and archival capabilities has been launched a few weeks ago with Amazon S3 as the storage service supporting videos of up to 10 GB each. The S3 bucket is configured for Virginia (us-east-1) Region. The application is gaining a lot of traction in Melbourne and Sydney cities of Australia. The users of these cities have been complaining of slow uploads and regular timeouts while using the application.

Which of the following options can be used to speed up the uploads and enhance the user experience?

Configure an Amazon S3 bucket in every AWS Region that has a good user base. Use S3 replication to sync all the S3 buckets and serve the videos with minimum latency

Extend your AWS infrastructure by configuring AWS outposts on the edge locations of AWS regions with a good user base. Data of the Amazon S3 buckets are stored on the outposts to provide low latency (both upload and download)access to the user

Your answer is correct

To upload video files to Amazon S3 bucket, leverage multipart uploads feature. Configure the application to use S3 Transfer Acceleration endpoints to improve the performance of uploads and also optimize the multipart uploads

To upload video files to Amazon S3 bucket, leverage multipart uploads feature. Configure CloudFront distribution with Amazon S3 bucket as the origin to minimize latency and enhance user experience

Overall explanation

Correct option:

To upload video files to an Amazon S3 bucket, leverage the multipart uploads feature. Configure the application to use S3 Transfer Acceleration endpoints to improve the performance of uploads and also optimize the multipart uploads

When you upload large files to Amazon S3, it's a best practice to leverage multipart uploads. If you're using the AWS Command Line Interface (AWS CLI), then all high-level AWS s3 commands automatically perform a multipart upload when the object is large. These high-level commands include aws s3 cp and aws s3 sync.

Consider the following options for improving the performance of uploads and optimizing multipart uploads: 1. If you're using the AWS CLI, customize the upload configurations. 2. Enable Amazon S3 Transfer Acceleration.

Using CLI to customize the upload configurations:

via - https://aws.amazon.com/premiumsupport/knowledge-center/s3-upload-large-files/

Amazon S3 Transfer Acceleration can speed up content transfers to and from Amazon S3 by as much as 50%-500% for long-distance transfer of larger objects. Customers who have either web or mobile applications with widespread users or applications hosted far away from their S3 bucket can experience long and variable upload and download speeds over the Internet. S3 Transfer Acceleration (S3TA) reduces the variability in Internet routing, congestion, and speeds that can affect transfers, and logically shortens the distance to S3 for remote applications. S3TA improves transfer performance by routing traffic through Amazon CloudFront’s globally distributed Edge Locations and over AWS backbone networks, and by using network protocol optimizations. You can turn on S3TA with a few clicks in the S3 console, and test its benefits from your location with a speed comparison tool. With S3TA, you pay only for transfers that are accelerated.

Amazon S3 Transfer Acceleration Speed Comparison can be checked from http://s3-accelerate-speedtest.s3-accelerate.amazonaws.com/en/accelerate-speed-comparsion.html

Incorrect options:

To upload video files to an Amazon S3 bucket, leverage the multipart uploads feature. Configure CloudFront distribution with Amazon S3 bucket as the origin to minimize latency and enhance user experience - Amazon S3 Transfer Acceleration can enhance the performance of multipart uploads to the Amazon S3 bucket. AWS recommends it as a best practice too. CloudFront is much more relevant for cases where videos are shared online, this use case is for performance enhancement for video uploads and hence this option is not an optimal solution.

Configure an Amazon S3 bucket in every AWS Region that has a good user base. Use S3 replication to sync all the S3 buckets and serve the videos with minimum latency - Amazon S3 Replication enables automatic, asynchronous copying of objects across Amazon S3 buckets. For the given use case, we need a solution that can improve the video upload capabilities, rather than serving the video with minimum latency.

Extend your AWS infrastructure by configuring AWS outposts on the edge locations of AWS regions with a good user base. Data of the Amazon S3 buckets are stored on the outposts to provide low latency (both upload and download) access to the user - AWS Outposts is a family of fully managed solutions delivering AWS infrastructure and services to virtually any on-premises or edge location for a truly consistent hybrid experience. Outposts solutions allow you to extend and run native AWS services on-premises and are available in a variety of form factors. The given use case has no on-premises servers hence using AWS outposts is irrelevant to this solution.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration-examples.html

https://aws.amazon.com/premiumsupport/knowledge-center/s3-upload-large-files/

Domain

Design Solutions for Organizational Complexity

Question 33Correct

A solutions architect is setting up DNS failover configuration for Route 53. The architect needs to use multiple routing policies (such as latency-based and weighted) to configure a more complex DNS failover.

Which of the following options represent the key points of consideration while setting up a failover configuration on Route 53? (Select two)

More than half of the configured records with nonzero weights must be unhealthy before Route 53 starts to respond to DNS queries using records that have weights of zero

If you're routing traffic to any AWS resources that you can create alias records for, you need to create health checks for these resources too

Your selection is correct

Records without a health check are always considered healthy. If no record is healthy, all records are deemed to be healthy

Your selection is correct

If you're creating failover records in a private hosted zone, you must assign a public IP address to an instance in the VPC to check the health of an endpoint within a VPC by IP address

When responding to queries, Route 53 includes only the healthy primary resources in Active-active failover configuration

Overall explanation

Correct options:

Records without a health check are always considered healthy. If no record is healthy, all records are deemed to be healthy - If a record in a group of records that have the same name and type doesn't have an associated health check, Route 53 always considers it healthy and always includes it among possible responses to a query.

If none of the records in a group of records are healthy, Route 53 needs to return something in response to DNS queries, but it has no basis for choosing one record over another. In this circumstance, Route 53 considers all the records in the group to be healthy and selects one based on the routing policy and on the values that you specify for each record.

If you're creating failover records in a private hosted zone, you must assign a public IP address to an instance in the VPC to check the health of an endpoint within a VPC by IP address

If you're creating failover records in a private hosted zone, note the following:

Route 53 health checkers are outside the VPC. To check the health of an endpoint within a VPC by IP address, you must assign a public IP address to an instance in the VPC.

You can create a CloudWatch metric, associate an alarm with the metric, and then create a health check that is based on the data stream for the alarm.

Incorrect options:

If you're routing traffic to any AWS resources that you can create alias records for, you need to create health checks for these resources too - If you're routing traffic to any AWS resources that you can create alias records for, don't create health checks for those resources. When you create the alias records, you set Evaluate Target Health to Yes instead.

More than half of the configured records with nonzero weights must be unhealthy before Route 53 starts to respond to DNS queries using records that have weights of zero - All the records with non-zero weights must be unhealthy before Route 53 starts to respond to DNS queries using records that have weights of zero.

When responding to queries, Route 53 includes only the healthy primary resources for active-active failover configuration - In active-active failover, all the records that have the same name, the same type, and the same routing policy are active unless Route 53 considers them unhealthy. Route 53 can respond to a DNS query using any healthy record.

In active-passive failover, when responding to queries, Route 53 includes only the healthy primary resources. If all the primary resources are unhealthy, Route 53 begins to include only the healthy secondary resources in response to DNS queries.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-types.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/health-checks-how-route-53-chooses-records.html

Domain

Design Solutions for Organizational Complexity

Question 34Correct

An e-commerce company has created a data warehouse using Redshift that is used to analyze data from Amazon S3. From the usage patterns, the analytics team has detected that after 30 days, the data is rarely queried in Redshift and it's not "hot data" anymore. The team would like to preserve the SQL querying capability on the data and get the queries started immediately. Also, the team wants to adopt a pricing model that allows the company to save the maximum amount of cost on Redshift.

Which of the following options would you recommend? (Select two)

Your selection is correct

Transition the data to S3 Standard IA after 30 days

Transition the data to S3 Glacier Deep Archive after 30 days

Migrate the Redshift underlying storage to S3 IA

Your selection is correct

Analyze the cold data with Athena

Create a smaller Redshift Cluster with the cold data

Overall explanation

Correct options:

Transition the data to S3 Standard IA after 30 days - S3 Standard-IA is for data that is accessed less frequently but requires rapid access when needed. S3 Standard-IA offers high durability, high throughput, and low latency of S3 Standard, with a low per GB storage price and per GB retrieval fee. This combination of low cost and high performance makes S3 Standard-IA ideal for long-term storage, backups, and as a data store for disaster recovery files. The minimum storage duration charge is 30 days.

via - https://aws.amazon.com/s3/storage-classes/

Analyze the cold data with Athena - Amazon Athena is an interactive query service that makes it easy to analyze data directly in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to set up or manage, and customers pay only for the queries they run. You can use Athena to process logs, perform ad-hoc analysis, and run interactive queries.

Moving the data to S3 Glacier will prevent us from being able to query it. Therefore, we should migrate the data to S3 Standard IA and use Athena to analyze the cold data.

Incorrect options:

Migrate the Redshift underlying storage to S3 IA - Amazon Redshift is a fully-managed petabyte-scale cloud-based data warehouse product designed for large-scale data set storage and analysis. An Amazon Redshift data warehouse is a collection of computing resources called nodes, which are organized into a group called a cluster. Each cluster runs an Amazon Redshift engine and contains one or more databases. An Amazon Redshift cluster consists of nodes. Each cluster has a leader node and one or more compute nodes. The leader node receives queries from client applications, parses the queries, and develops query execution plans. The leader node then coordinates the parallel execution of these plans with the compute nodes and aggregates the intermediate results from these nodes. It then finally returns the results to the client applications.

Redshift's internal storage does not have "tiers" of storage classes like Amazon S3, so this option is also ruled out.

Create a smaller Redshift Cluster with the cold data - Creating a smaller cluster with the cold data would not decrease the storage cost of Redshift, which will only increase with time as we keep on creating data. Therefore this option is ruled out.

Transition the data to S3 Glacier Deep Archive after 30 days - Amazon S3 Glacier Deep Archive (GDA) is a secure, durable, and extremely low-cost Amazon S3 cloud storage class for data archiving and long-term backup. It is designed to deliver 99.999999999% durability, and provide comprehensive security and compliance capabilities that can help meet even the most stringent regulatory requirements. GDA has a first-byte latency of several hours, so this option is incorrect.

References:

https://aws.amazon.com/athena/

https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html

Domain

Accelerate Workload Migration and Modernization

Question 35Correct

You have hired a Cloud consulting agency, Example Corp, to monitor your AWS account and help optimize costs. To track daily spending, Example Corp needs access to your AWS resources, therefore, you allow Example Corp to assume an IAM role in your account. However, Example Corp also tracks spending for other customers, and there could be a configuration issue in the Example Corp environment that allows another customer to compel Example Corp to attempt to take an action in your AWS account, even though that customer should only be able to take the action in their account.

How will you mitigate the risk of such a cross-account access scenario?

Your answer is correct

Create an IAM role in your AWS account with a trust policy that trusts the Partner (Example Corp). Take a unique external ID value from Example Corp and include this external ID condition in the role’s trust policy

Create an IAM role in your AWS account with a trust policy that trusts the Partner (Example Corp). Create a unique external ID value for Example Corp and include this external ID condition in the role’s trust policy. Share this unique ID with Example Corp

Configure a workforce authentication using SAML 2.0 federation. Employees of Example Corp can access the needed AWS resources with this integration

Create an IAM role in your AWS account with a trust policy that trusts the Partner (Example Corp). Use the AWS account ID of Example Corp as the principal element of the trust policy that can assume the role

Overall explanation

Correct option:

Create an IAM role in your AWS account with a trust policy that trusts the Partner (Example Corp). Take a unique external ID value from Example Corp and include this external ID condition in the role’s trust policy

At a high level, the external ID is a piece of data that can be passed to the AssumeRole API of the Security Token Service (STS). You can then use the external ID in the condition element in a role’s trust policy, allowing the role to be assumed only when a certain value is present in the external ID.

In abstract terms, the external ID allows the user that is assuming the role to assert the circumstances in which they are operating. It also provides a way for the account owner to permit the role to be assumed only under specific circumstances. This addresses the given scenario, also known as the confused deputy problem.

Explaining the confused deputy problem:

via - https://aws.amazon.com/blogs/security/how-to-use-external-id-when-granting-access-to-your-aws-resources/

You address the confused deputy problem by including the external ID condition in the role’s trust policy. The external ID corresponds to a unique customer identifier that is generated by Example Corp. The external ID value must be unique among Example Corp’s customers, and this is why you get it from Example Corp (you don’t come up with the external ID value on your own). Only Example Corp is in a position to guarantee unique external ID values for each of its customers.

How the external ID solves the problem:

via - https://aws.amazon.com/blogs/security/how-to-use-external-id-when-granting-access-to-your-aws-resources/

Incorrect options:

Create an IAM role in your AWS account with a trust policy that trusts the Partner (Example Corp). Create a unique external ID value for Example Corp and include this external ID condition in the role’s trust policy. Share this unique ID with Example Corp - As discussed above, the unique external ID is given by the third party which is Example Corp in this scenario. You, as AWS resource owner will not be able to define unique IDs for the partner systems.

Create an IAM role in your AWS account with a trust policy that trusts the Partner (Example Corp). Use the AWS account ID of Example Corp as the principal element of the trust policy that can assume the role - This will further exacerbate the problem, as any user who has access to the AWS account can manipulate the resources.

Configure a workforce authentication using SAML 2.0 federation. Employees of Example Corp can access the needed AWS resources with this integration - This occurs when customers federate their users into AWS from their corporate identity provider (IdP) such as Okta, Microsoft Azure Active Directory, or Active Directory Federation Services (ADFS), or AWS IAM Identity Center (successor to AWS Single Sign-On). This feature is not useful for the current use case since the requirement is not about providing AWS access to external users of a corporation/company without creating AWS accounts for each user.

References:

https://aws.amazon.com/blogs/security/how-to-use-external-id-when-granting-access-to-your-aws-resources/

https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/

Domain

Continuous Improvement for Existing Solutions

Question 36Correct

An e-commerce company runs its flagship website on its on-premises Linux servers. Recently, the company suffered outages after announcing huge discounts on its website. The web tier of the application is fronted by Elastic Load Balancer while the database tier is built on RDS MYSQL database. The company is planning to run heavy discounts for the upcoming holiday sales season. The company is looking for a solution to avoid any similar outages as well as quickly ramp up the ability to handle huge traffic spikes.

As an AWS Certified Solutions Architect Professional, which of the following would you suggest as the most optimal solution that can enhance the application's capabilities to handle the sudden spikes in user traffic without significant development effort?

Change the application architecture to use Docker containers and redeploy on AWS with ECS

Create an S3 bucket and configure it for website hosting. Migrate your DNS to Route53 and leverage Route53 DNS failover to failover to the S3 hosted website

Your answer is correct

Create a CloudFront distribution and configure CloudFront to cache objects from a custom origin. This will offload some traffic from the on-premises servers. Customize CloudFront cache behavior by setting Time To Live (TTL) to suit your business requirement

Lift and Shift the application using AWS Elastic Beanstalk to enhance the scalability of the application without any downtime on the existing one

Overall explanation

Correct option:

Create a CloudFront distribution and configure CloudFront to cache objects from a custom origin. This will offload some traffic from the on-premises servers. Customize CloudFront cache behavior by setting Time To Live (TTL) to suit your business requirement

CloudFront distribution supports custom origin servers. You can control how long your files stay in a CloudFront cache before CloudFront forwards another request to your origin. Reducing the duration allows you to serve dynamic content. Increasing the duration means that your users get better performance because your files are more likely to be served directly from the edge cache. A longer duration also reduces the load on your origin.

Typically, CloudFront serves a file from an edge location until the cache duration that you specified passes—that is until the file expires. After it expires, the next time the edge location gets a user request for the file, CloudFront forwards the request to the origin server to verify that the cache contains the latest version of the file. To change the cache duration for all files that match the same path pattern, you can change the CloudFront settings for Minimum TTL, Maximum TTL, and Default TTL for a cache behavior.

The CloudFront cache will offload some traffic from the on-premises servers thereby improving the performance as well as scale the ability to handle any traffic spikes.

Incorrect options:

Change the application architecture to use Docker containers and redeploy on AWS with ECS - This requires writing custom code and hence is not a feasible solution for the given scenario as it involves significant development effort.

Lift and Shift the application using AWS Elastic Beanstalk to enhance the scalability of the application without any downtime on the existing one - The company is looking for an immediate solution that can handle the peak traffic for the upcoming holiday season, hence AWS Elastic Beanstalk is not the right choice here as it involves significant changes in the underlying architecture.

Create an S3 bucket and configure it for website hosting. Migrate your DNS to Route53 and leverage Route53 DNS failover to failover to the S3 hosted website - Amazon S3 can be used for hosting static websites only. Since the use case does not specifically mention the content being static, this option is ruled out.

Reference:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html

Domain

Continuous Improvement for Existing Solutions

Question 37Correct

A retail company is deploying a critical application on multiple EC2 instances in a VPC. Per the company policy, any failed client connections to the EC2 instances must be logged.

Which of the following options would you recommend as the MOST cost-effective solution to address these requirements?

Migrate the EC2 instances to a dedicated VPC. Configure VPC Flow Logs with a filter on the reject action. Publish the Flow Logs to a Kinesis Data Firehose stream with the data delivery to an S3 bucket

Migrate the EC2 instances to a dedicated VPC. Configure VPC Flow Logs with a filter on the reject action. Publish the Flow Logs to Amazon CloudWatch Logs

Set up VPC Flow Logs for the elastic network interfaces associated with the instances and configure the VPC Flow Logs to be filtered for rejected traffic. Publish the Flow Logs to Kinesis Data Streams with the data delivery to an S3 bucket

Your answer is correct

Set up VPC Flow Logs for the elastic network interfaces associated with the instances and configure the VPC Flow Logs to be filtered for rejected traffic. Publish the Flow Logs to CloudWatch Logs

Overall explanation

Correct option:

Set up VPC Flow Logs for the elastic network interfaces associated with the instances and configure the VPC Flow Logs to be filtered for rejected traffic. Publish the Flow Logs to CloudWatch Logs

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs or Amazon S3. After you've created a flow log, you can retrieve and view its data in the chosen destination.

You can create a flow log for a VPC, a subnet, or a network interface. If you create a flow log for a subnet or VPC, each network interface in that subnet or VPC is monitored.

Flow logs can help you with a number of tasks, such as:

Diagnosing overly restrictive security group rules

Monitoring the traffic that is reaching your instance

Determining the direction of the traffic to and from the network interfaces

via - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

For the given use case, you can configure the VPC Flow Logs only for the elastic network interfaces associated with the instances and set the type of traffic to be captured as rejected traffic only. Lastly, you can publish the Flow Logs to Amazon CloudWatch Logs.

Incorrect options:

Set up VPC Flow Logs for the elastic network interfaces associated with the instances and configure the VPC Flow Logs to be filtered for rejected traffic. Publish the Flow Logs to Kinesis Data Streams with the data delivery to an S3 bucket - Flow Logs data can only be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose. Kinesis Data Firehose is a streaming ETL solution. It is the easiest way to load streaming data into data stores and analytics tools. It can capture, transform, and load streaming data into Amazon S3, Amazon Redshift, Amazon Elasticsearch Service, and Splunk. You cannot publish Flow Logs to Kinesis Data Streams, so this option is incorrect.

Migrate the EC2 instances to a dedicated VPC. Configure VPC Flow Logs with a filter on the reject action. Publish the Flow Logs to Amazon CloudWatch Logs

Migrate the EC2 instances to a dedicated VPC. Configure VPC Flow Logs with a filter on the reject action. Publish the Flow Logs to a Kinesis Data Firehose stream with the data delivery to an S3 bucket

Dedicated tenancy ensures all EC2 instances that are launched in a VPC run on hardware that's dedicated to a single customer. Dedicated Instances are Amazon EC2 instances that run in a VPC on hardware that's dedicated to a single customer. Your Dedicated instances are physically isolated at the host hardware level from instances that belong to other AWS accounts. Dedicated instances may share hardware with other instances from the same AWS account that are not Dedicated instances. You can also use Dedicated Hosts to launch Amazon EC2 instances on physical servers that are dedicated for your use. Dedicated Hosts give you additional visibility and control over how instances are placed on a physical server, and you can reliably use the same physical server over time.

Dedicated Instance pricing has two components: (1) an hourly per instance usage fee and (2) a dedicated per region fee (note that you pay this once per hour regardless of how many Dedicated Instances you're running). Therefore dedicated VPC turns out to be a costlier solution. So both these options are incorrect for the given use case.

References:

https://aws.amazon.com/about-aws/whats-new/2017/10/switch-the-tenancy-of-your-vpc-from-dedicated-to-default-instantly/

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

Domain

Accelerate Workload Migration and Modernization

Question 38Correct

A company has hired you as an AWS Certified Solutions Architect Professional to develop a deployment plan for its flagship application deployed on EC2 instances across multiple Availability Zones in the us-east-1 Region. Your solution must meet these constraints:

1) A 300 GB static dataset must be available to the application before it can be started

2) The application layer must scale on-demand with the least amount of starting time possible

3) The development team must be able to change the code multiple times in a day

4) Any patches for critical operating systems (OS) must be applied within 24 hours of release

Which of the following represents the best solution for this requirement?

Leverage AWS Systems Manager to create and maintain a new AMI with the OS patches updated on an ongoing basis. Configure the Auto Scaling group to use the patched AMI and replace existing unpatched instances. Use AWS CodeDeploy to push the application code to the instances. Store and access the static dataset using Amazon EBS

Your answer is correct

Leverage AWS Systems Manager to create and maintain a new AMI with the OS patches updated on an ongoing basis. Configure the Auto Scaling group to use the patched AMI and replace existing unpatched instances. Use AWS CodeDeploy to push the application code to the instances. Store and access the static dataset using Amazon EFS

Leverage an Amazon-provided AMI for the OS and set up an Auto Scaling group to scale with traffic. Replace existing instances after each updated Amazon-provided AMI release. Use AWS CodeDeploy to push the application code to the instances. Configure an Amazon EC2 user data script to download the static dataset from Amazon S3

Leverage AWS Systems Manager to create and maintain a new AMI with the OS patches updated on an ongoing basis. Configure the Auto Scaling group to use the patched AMI and replace existing unpatched instances. Use AWS CodeDeploy to push the application code to the instances. Configure an Amazon EC2 user data script to download the static dataset from Amazon S3

Overall explanation

Correct option:

Leverage AWS Systems Manager to create and maintain a new AMI with the OS patches updated on an ongoing basis. Configure the Auto Scaling group to use the patched AMI and replace existing unpatched instances. Use AWS CodeDeploy to push the application code to the instances. Store and access the static dataset using Amazon EFS

You can use AWS Systems Manager to view and control your infrastructure on AWS. Using the Systems Manager console, you can view operational data from multiple AWS services and automate operational tasks across your AWS resources.

For the given use case, you can leverage AWS Systems Manager to create a maintenance window, and then register an Automation task to automate the creation of the AMI. This process is applicable for both Windows and Linux instances. You can create and run a Systems Manager runbook that patches the AMI on an ongoing basis. You can then add a step that updates an Auto Scaling group with the newly patched AMI. This approach ensures that new images are automatically made available to different computing environments that use Auto Scaling groups. You can further automate the deployment of the new AMI by using a Lambda function to gracefully terminate existing instances, thereby ensuring that all instances use the latest patched AMI.

via - https://aws.amazon.com/application-migration-service/

AWS CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers. You can use CodeDeploy to push the application code to the instances.

While EFS is a managed elastic file system designed for use across different machines and Availability Zones, EBS is designed as a fast and reliable block storage volume for single machines (although you could use EBS Multi-Attach that allows you to attach a single Provisioned IOPS SSD (io1 or io2) volume to multiple instances that are in the same Availability Zone). EFS is the right fit for the given use case as the instances are spread across multiple Availability Zones. Loading the 300 GB dataset on EFS would also ensure that this dataset is immediately available to the application on all new instances.

How EFS works:

via - https://aws.amazon.com/efs/

Incorrect options:

Leverage AWS Systems Manager to create and maintain a new AMI with the OS patches updated on an ongoing basis. Configure the Auto Scaling group to use the patched AMI and replace existing unpatched instances. Use AWS CodeDeploy to push the application code to the instances. Store and access the static dataset using Amazon EBS - EBS is designed as a fast and reliable block storage volume for single machines (although you could use EBS Multi-Attach which allows you to attach a single Provisioned IOPS SSD (io1 or io2) volume to multiple instances that are in the same Availability Zone). EBS is not the right fit for the given use case as the instances are spread across multiple Availability Zones.

Leverage AWS Systems Manager to create and maintain a new AMI with the OS patches updated on an ongoing basis. Configure the Auto Scaling group to use the patched AMI and replace existing unpatched instances. Use AWS CodeDeploy to push the application code to the instances. Configure an Amazon EC2 user data script to download the static dataset from Amazon S3 - Leveraging EC2 user data to download the static dataset from Amazon S3 would lead to a delay in getting the application up and running on new instances since the application depends on this static dataset before it can be started. So this option is not the best fit.

Leverage an Amazon-provided AMI for the OS and set up an Auto Scaling group to scale with traffic. Replace existing instances after each updated Amazon-provided AMI release. Use AWS CodeDeploy to push the application code to the instances. Configure an Amazon EC2 user data script to download the static dataset from Amazon S3 - It is more efficient to use the Systems Manager to create and maintain a new AMI with the OS patches updated on an ongoing basis. Leveraging EC2 user data to download the static dataset from Amazon S3 would lead to a delay in getting the application up and running on new instances since the application depends on this static dataset before it can be started. So this option is not the best fit.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html

https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-walk-patch-windows-ami-autoscaling.html

https://aws.amazon.com/codedeploy/

Domain

Continuous Improvement for Existing Solutions

Question 39Correct

A financial services firm intends to migrate its IT operations to AWS. The security team is establishing a framework to ensure that AWS best practices are being followed. AWS management console is the only way used by the IT teams to provision AWS resources. As per the firm's compliance requirements, the AWS resources need to be maintained in a particular configuration and audited regularly for unauthorized changes.

As an AWS Certified Solutions Architect Professional, how will you implement this requirement? (Select two)

Leverage Systems Manager to view and control your infrastructure on AWS, and trigger AWS Lambda functions to automatically revert non-authorized changes in AWS infrastructure. Use SNS topics to enable notifications and improve the response time of incident responses

Leverage EventBridge events to monitor and evaluate system events patterns, and trigger AWS Lambda functions to automatically revert non-authorized changes in AWS resources. Use SNS topics to enable notifications and improve the response time of incident responses

Leverage CloudWatch Logs agent to aggregate all the AWS SDK logs. Analyze the log data using a pre-defined set of filter patterns that match any changes in the API calls. Trigger notifications via Amazon CloudWatch alarms when unintended changes are performed

Your selection is correct

Leverage AWS CloudTrail events to review management activities of all AWS accounts. Make sure that CloudTrail is enabled in all accounts for the available AWS services. Enable CloudTrail trails and encrypt CloudTrail event log files with an AWS KMS key and monitor the recorded events via CloudWatch Logs

Your selection is correct

Leverage AWS Config rules for auditing changes to AWS resources periodically and monitor the compliance of the configuration. Set up AWS Config custom rules using AWS Lambda to create a test-driven development approach, and finally automate the evaluation of configuration changes against the required controls

Overall explanation

Correct options:

Leverage AWS Config rules for auditing changes to AWS resources periodically and monitor the compliance of the configuration. Set up AWS Config custom rules using AWS Lambda to create a test-driven development approach, and finally automate the evaluation of configuration changes against the required controls - AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting. AWS Config service is tailor-made for this requirement.

Leverage AWS CloudTrail events to review management activities of all AWS accounts. Make sure that CloudTrail is enabled in all accounts for the available AWS services. Enable CloudTrail trails and encrypt CloudTrail event log files with an AWS KMS key and monitor the recorded events via CloudWatch Logs - AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs.

Visibility into your AWS account activity is a key aspect of security and operational best practices. You can use CloudTrail to view, search, download, archive, analyze, and respond to account activity across your AWS infrastructure. You can identify who or what took which action, what resources were acted upon, when the event occurred, and other details to help you analyze and respond to activity in your AWS account. Optionally, you can enable AWS CloudTrail Insights on a trail to help you identify and respond to unusual activity.

You can integrate CloudTrail into applications using the API, automate trail creation for your organization, check the status of trails you create, and control how users view CloudTrail events.

CloudTrail security best practices suggested by AWS are: 1. Create a trail 2. Apply trails to all AWS Regions 3. Enable CloudTrail log file integrity 4. Integrate with Amazon CloudWatch Logs

These steps are all covered in this option and hence it's the right choice for the given requirement.

Incorrect options:

Leverage Systems Manager to view and control your infrastructure on AWS, and trigger AWS Lambda functions to automatically revert non-authorized changes in AWS infrastructure. Use SNS topics to enable notifications and improve the response time of incident responses - AWS Systems Manager (formerly known as SSM) is an AWS service that you can use to view and control your infrastructure on AWS. Using the Systems Manager console, you can view operational data from multiple AWS services and automate operational tasks across your AWS resources. Systems Manager helps you maintain security and compliance by scanning your managed nodes and reporting on (or taking corrective action on) any policy violations it detects.

Systems Manager supports Amazon Elastic Compute Cloud (Amazon EC2) instances, edge devices, and on-premises servers and virtual machines (VMs). Beyond these resources, Systems Manager cannot be used for managing other AWS resources, so this option is incorrect.

Leverage CloudWatch Logs agent to aggregate all the AWS SDK logs. Analyze the log data using a pre-defined set of filter patterns that match any changes in the API calls. Trigger notifications via Amazon CloudWatch alarms when unintended changes are performed - The CloudWatch Logs agent provides an automated way to send log data to CloudWatch Logs only from Amazon EC2 instances. It cannot aggregate all the AWS SDK logs, so this option is incorrect.

Leverage EventBridge events to monitor and evaluate system events patterns, and trigger AWS Lambda functions to automatically revert non-authorized changes in AWS resources. Use SNS topics to enable notifications and improve the response time of incident responses - EventBridge events can certainly be used to monitor and evaluate system events patterns, however, it would involve significant development effort to handle all configuration changes across the AWS services. Using AWS Config with automated resource configuration management via Lambda functions is a better choice.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html

https://aws.amazon.com/config/

Domain

Accelerate Workload Migration and Modernization

Question 40Correct

A medical insurance company stores its bills and supporting documents of its customers in an Amazon S3 bucket as per the regulatory guidelines. The bucket is organized into folders with each folder having an insurance claim type. Employees working on claims have access to this S3 bucket and copy the bills and supporting documents to the folders based on the claim type. With changes in the regulations, the company has a new workflow for a new type of claim that exceeds a certain amount. These high-value claims have to be copied to a different bucket from where a program processes them within an hour. The workflow must trigger a ticket for the Audit team if the claim data is not copied into the destination bucket within 15 minutes.

Which is the most effective solution that can be quickly implemented to incorporate the necessary changes in the workflow?

Use Amazon S3 event notifications to track the creation of new objects in the particular folder. Trigger an AWS Lambda function to use S3 Transfer Acceleration to copy the new objects to the new S3 bucket. Leverage an Amazon S3 event notification to trigger a notification when the time to copy the claim data exceeds the desired threshold

Create a new Amazon S3 bucket to be used for replication. Create a new S3 Replication Time Control (S3 RTC) rule on the source S3 bucket that filters data based on the prefix (high-value claim type) and replicates it to the new S3 bucket. Leverage an Amazon EventBridge rule to trigger a notification when the time to copy the claim data exceeds the desired threshold

To move data easily between buckets, schedule a periodic transfer with AWS DataSync. DataSync is a fully managed service and can be configured to trigger notifications to track the status of the DataSync task. Leverage an Amazon EventBridge rule to trigger a notification when the time to copy the claim data exceeds the desired threshold

Your answer is correct

Create a new Amazon S3 bucket to be used for replication. Create a new S3 Replication Time Control (S3 RTC) rule on the source S3 bucket that filters data based on the prefix (high-value claim type) and replicates it to the new S3 bucket. Leverage an Amazon S3 event notification to trigger a notification when the time to copy the claim data exceeds the desired threshold

Overall explanation

Correct option:

Create a new Amazon S3 bucket to be used for replication. Create a new S3 Replication Time Control (S3 RTC) rule on the source S3 bucket that filters data based on the prefix (high-value claim type) and replicates it to the new S3 bucket. Leverage an Amazon S3 event notification to trigger a notification when the time to copy the claim data exceeds the desired threshold

S3 Replication Time Control (S3 RTC) helps you meet compliance or business requirements for data replication and provides visibility into Amazon S3 replication times. S3 RTC replicates most objects that you upload to Amazon S3 in seconds and 99.99 percent of those objects within 15 minutes.

You can start using S3 Replication Time Control (S3 RTC) with a new or existing replication rule. You can choose to apply your replication rule to an entire S3 bucket, or to Amazon S3 objects with a specific prefix or tag. When you enable S3 RTC, replication metrics are also enabled on your replication rule.

Replication rules with S3 Replication Time Control (S3 RTC) enabled publish replication metrics. With replication metrics, you can monitor the total number of S3 API operations that are pending replication, the total size of objects pending replication, and the maximum replication time to the destination Region. You can then monitor each dataset that you replicate separately.

You can track replication time for objects that did not replicate within 15 minutes by monitoring specific event notifications that S3 Replication Time Control (S3 RTC) publishes. These events are published when an object that was eligible for replication using S3 RTC didn't replicate within 15 minutes, and when that object replicates after the 15-minute threshold.

Replication events are available within 15 minutes of enabling S3 RTC. You can use Amazon S3 event notifications to track replication objects. Amazon EventBridge does not support receiving S3 object replication events.

via - https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-time-control.html

Incorrect options:

Use Amazon S3 event notifications to track the creation of new objects in the particular folder. Trigger an AWS Lambda function to use S3 Transfer Acceleration to copy the new objects to the new S3 bucket. Leverage an Amazon S3 event notification to trigger a notification when the time to copy the claim data exceeds the desired threshold - Amazon S3 Transfer Acceleration can speed up content transfers to and from Amazon S3 by as much as 50%-500% for long-distance transfer of larger objects. Customers who have either web or mobile applications with widespread users or applications hosted far away from their S3 bucket can experience long and variable upload and download speeds over the Internet. S3 Transfer Acceleration (S3TA) reduces the variability in Internet routing, congestion, and speeds that can affect transfers, and logically shortens the distance to S3 for remote applications. S3 Transfer Acceleration is not the right fit for the given bucket-to-bucket replication scenario.

To move data easily between buckets, schedule a periodic transfer with AWS DataSync. DataSync is a fully managed service and can be configured to trigger notifications to track the status of the DataSync task. Leverage an Amazon EventBridge rule to trigger a notification when the time to copy the claim data exceeds the desired threshold - AWS DataSync is an online data movement and discovery service that simplifies and accelerates data migrations to AWS as well as moving data between on-premises storage, edge locations, other clouds, and AWS Storage. While AWS DataSync can be used with S3 storage service, DataSync is not the best fit for bucket-to-bucket replication. In addition, Amazon S3 object replication events are not sent to EventBridge, so this option is incorrect.

Create a new Amazon S3 bucket to be used for replication. Create a new S3 Replication Time Control (S3 RTC) rule on the source S3 bucket that filters data based on the prefix (high-value claim type) and replicates it to the new S3 bucket. Leverage an Amazon EventBridge rule to trigger a notification when the time to copy the claim data exceeds the desired threshold - Amazon S3 object replication events are not sent to EventBridge, so this option is incorrect.

List of Amazon S3 events sent to Amazon EventBridge:

via - https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-time-control.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html#supported-notification-destinations

https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html#supported-notification-event-types

Domain

Design for New Solutions

Question 41Correct

The development team at a company has noticed issues with the Quality of Service (QoS) in the traffic to the EC2 instances hosting a VOIP program. The team needs to inspect the network packets to determine if it is a programming error or a networking error.

As an AWS Certified Solutions Architect Professional, which of the following options would you suggest for the given use case?

Your answer is correct

Configure traffic mirroring on the source EC2 instances hosting the VOIP program, set up a network monitoring program on a target EC2 instance and stream the logs to an S3 bucket for further analysis

Use VPC Flow Logs to inspect the network packets

Provision another EC2 instance with an ENI added to act as a monitoring interface. Configure the port to promiscuous mode and sniff the traffic to analyze the packets. Direct the output of this single stream to an S3 bucket for further analysis

Use CloudWatch to inspect the network packets

Overall explanation

Correct option:

Configure traffic mirroring on the source EC2 instances hosting the VOIP program, set up a network monitoring program on a target EC2 instance and stream the logs to an S3 bucket for further analysis

Quality of Service (QoS) is a set of technologies that enable a network to dependably run high-priority applications and traffic under limited network capacity. QoS technologies accomplish this by providing differentiated handling and capacity allocation to specific flows in network traffic. Bandwidth (throughput), latency (delay), jitter (variance in latency), and error rate are the metrics relevant to QoS. This implies that QoS is of particular importance to high-bandwidth, real-time traffic such as voice over IP (VoIP), video conferencing, and video-on-demand that have a high sensitivity to latency and jitter.

Generally, the promiscuous mode allows the user to bypass the normal operation mode by forwarding all traffic it receives to the CPU. However for AWS, even if you can turn your NIC to Promiscuous mode, the hypervisor will never pass traffic intended for another virtual machine to your EC2 instance. You need to use traffic mirroring as it allows you to copy traffic passing through an elastic network adaptor and send it toward another instance for further investigation. For the given use case, you need to set up traffic mirroring on the source EC2 instances hosting the VOIP program and then install a network monitoring program (such as Wireshark) on the traffic mirroring target EC2 instance. Finally, you can stream the logs from the target EC2 instance to an S3 bucket for further analysis.

Incorrect options:

Use CloudWatch to inspect the network packets - Amazon CloudWatch is a monitoring service for AWS cloud resources and the applications you run on AWS. You can use Amazon CloudWatch to collect and track metrics, collect and monitor log files, and set alarms. CloudWatch cannot be used to inspect the network packets.

Use VPC Flow Logs to inspect the network packets - VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs or Amazon S3. You can create a flow log for a VPC, a subnet, or a network interface. If you create a flow log for a subnet or VPC, each network interface in that subnet or VPC is monitored. VPC Flow Logs cannot be used to inspect the network packets.

Provision another EC2 instance with an ENI added to act as a monitoring interface. Configure the port to promiscuous mode and sniff the traffic to analyze the packets. Direct the output of this single stream to an S3 bucket for further analysis - Amazon EC2 instances running with an Amazon VPC have built-in protection against packet sniffing. It is not possible for a virtual instance running in promiscuous mode to receive or “sniff” traffic that is intended for a different virtual instance. While customers can place their interfaces into promiscuous mode, the hypervisor will not deliver any traffic to them that is not addressed to them. Even two virtual instances that are owned by the same customer located on the same physical host cannot listen to each other’s traffic. So this option is incorrect.

References:

https://d1.awsstatic.com/whitepapers/Security/Networking_Security_Whitepaper.pdf

https://medium.com/@macsat101/packet-sniffing-using-wireshark-on-aws-183b7983685d

https://www.paloaltonetworks.com/cyberpedia/what-is-quality-of-service-qos

Domain

Design for New Solutions

Question 42Correct

A solutions architect at a company is looking at connecting the company's Amazon EC2 instances to the confidential data stored on Amazon S3 storage. The architect has a requirement to use private IP addresses from the company's VPC to access Amazon S3 while also having the ability to access S3 buckets from the company's on-premises systems. In a few months, the S3 buckets will also be accessed from a VPC in another AWS Region.

What is the BEST way to build a solution to meet this requirement?

Set up Gateway endpoints for Amazon S3

Your answer is correct

Set up Interface endpoints for Amazon S3

Set up a private virtual interface (VIF) to connect to Amazon S3

Set up a virtual private gateway to connect to Amazon S3

Overall explanation

Correct option:

Set up Interface endpoints for Amazon S3 - You can use two types of VPC endpoints to access Amazon S3: gateway endpoints and interface endpoints. A gateway endpoint is a gateway that you specify in your route table to access Amazon S3 from your VPC over the AWS network. Interface endpoints extend the functionality of gateway endpoints by using private IP addresses to route requests to Amazon S3 from within your VPC, on-premises, or from a VPC in another AWS Region using VPC peering or AWS Transit Gateway. Interface endpoints are compatible with gateway endpoints. If you have an existing gateway endpoint in the VPC, you can use both types of endpoints in the same VPC.

Differences between Gateway and Interface endpoints:

via - https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3

Incorrect options:

Set up Gateway endpoints for Amazon S - A Gateway endpoint is a gateway that you specify in your route table to access Amazon S3 from your VPC over the AWS network. Gateway endpoint uses Amazon S3 public IP addresses and does not allow access from on-premises systems.

Set up a virtual private gateway to connect to Amazon S3 - For AWS Site-to-Site VPN connections, a virtual private gateway is the VPN concentrator on the Amazon side of the Site-to-Site VPN connection. You use a virtual private gateway or a transit gateway as the gateway for the Amazon side of the Site-to-Site VPN connection. For Direct Connect connections, you can use an AWS Direct Connect gateway to connect your AWS Direct Connect connection over a private virtual interface to one or more VPCs in any account that are located in the same or different Regions. You associate a Direct Connect gateway with the virtual private gateway for the VPC. The virtual private gateway must be attached to the VPC to which you want to connect. It is not used to connect to S3.

Set up a private Virtual Interface (VIF) to connect to Amazon S3 - When using an AWS Direct Connect connection, a private Virtual Interface is used to access an Amazon VPC using private IP addresses. It is not a feature of S3.

Reference:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3

Domain

Accelerate Workload Migration and Modernization

Question 43Incorrect

A retail company has two web applications and wants to run them in separate, isolated VPCs. The company is looking at using Elastic Load Balancing to distribute requests between application instances. The security and compliance team at the company has imposed the following restrictions:

Inbound HTTP requests to the application must be routed through a centralized VPC

Application VPCs must not be exposed to any other inbound traffic

Application VPCs cannot be allowed to initiate any outbound connections

Internet gateways must not be attached to the application VPCs

Which of the following solutions would you recommend to address these requirements?

Correct answer

Configure the applications behind private Network Load Balancers (NLBs) in separate VPCs. Set up each NLB as an AWS PrivateLink endpoint service with associated VPC endpoints in the centralized VPC. Set up a public Application Load Balancer (ALB) in the centralized VPC and point the target groups to the private IP addresses of each endpoint. Set up host-based routing to route application traffic to the corresponding target group through the ALB

Configure the applications behind private Application Load Balancers (ALBs) in separate VPCs. Set up a public Network Load Balancer (NLB) in the centralized VPC and point the target groups to the private IP addresses of the ALBs. Set up host-based routing to route application traffic to the corresponding target group through the NLB

Configure the applications behind private Network Load Balancers (NLBs) in separate VPCs. Set up VPC Peering between application VPCs and the centralized VPC. Set up a public Application Load Balancer (ALB) in the centralized VPC and point the target groups to the private DNS names of the NLBs. Set up host-based routing to route application traffic to the corresponding target group through the ALB

Your answer is incorrect

Configure the applications behind private Application Load Balancers (ALBs) in separate VPCs. Set up a public Network Load Balancer (NLB) in the centralized VPC and point the target groups to the ALBs. Set up host-based routing to route application traffic to the corresponding target group through the NLB

Overall explanation

Correct option:

Configure the applications behind private Network Load Balancers (NLBs) in separate VPCs. Set up each NLB as an AWS PrivateLink endpoint service with associated VPC endpoints in the centralized VPC. Set up a public Application Load Balancer (ALB) in the centralized VPC and point the target groups to the private IP addresses of each endpoint. Set up host-based routing to route application traffic to the corresponding target group through the ALB

Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, Lambda functions, and virtual appliances.

An Application Load Balancer functions at the application layer, the seventh layer of the Open Systems Interconnection (OSI) model. After the load balancer receives a request, it evaluates the listener rules in priority order to determine which rule to apply and then selects a target from the target group for the rule action. Application Load Balancer is best suited for load balancing of HTTP and HTTPS traffic and provides advanced request routing targeted at the delivery of modern application architectures, including microservices and containers.

Further, you can create Application Load Balancer rules that route incoming traffic based on the domain name specified in the Host header. Requests to api.example.com can be sent to one target group, requests to mobile.example.com to another, and all others (by way of a default rule) can be sent to a third. You can also create rules that combine host-based routing and path-based routing. This would allow you to route requests to api.example.com/production and api.example.com/sandbox to distinct target groups.

via - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html

A Network Load Balancer functions at the fourth layer of the Open Systems Interconnection (OSI) model. It can handle millions of requests per second. A load balancer serves as the single point of contact for clients. The load balancer distributes incoming traffic across multiple targets, such as Amazon EC2 instances. This increases the availability of your application. You add one or more listeners to your load balancer. A listener checks for connection requests from clients, using the protocol and port that you configure, and forwards requests to a target group. Each target group routes requests to one or more registered targets, such as EC2 instances, using the TCP protocol and the port number that you specify.

AWS PrivateLink is a highly available, scalable technology that enables you to privately connect your VPC to supported AWS services, services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services. You can create your own application in your VPC and configure it as an AWS PrivateLink-powered service (referred to as an endpoint service). Other AWS principals can create a connection from their VPC to your endpoint service using an interface VPC endpoint or a Gateway Load Balancer endpoint, depending on the type of service. You are the service provider, and the AWS principals that create connections to your service are service consumers.

via - https://docs.aws.amazon.com/vpc/latest/privatelink/endpoint-services-overview.html

For the given use case, you need to configure each NLB as an AWS PrivateLink endpoint service with associated VPC endpoints in the centralized VPC and then have the Application Load Balancer (ALB) in the centralized VPC point their target groups to the private IP addresses of each VPC endpoint. Finally, you will configure host-based routing on the ALB to route each application's traffic to the corresponding target group.

Incorrect options:

Configure the applications behind private Network Load Balancers (NLBs) in separate VPCs. Set up VPC Peering between application VPCs and the centralized VPC. Set up a public Application Load Balancer (ALB) in the centralized VPC and point the target groups to the private DNS names of the NLBs. Set up host-based routing to route application traffic to the corresponding target group through the ALB - Setting up VPC peering between application VPCs and the centralized VPC would violate the restrictions imposed on the inbound and outbound traffic for the application VPCs. In addition, you cannot point the ALB's target groups to the private DNS names of the NLB as the supported target types are EC2 instances, private IP addresses, and Lambda functions only.

Configure the applications behind private Application Load Balancers (ALBs) in separate VPCs. Set up a public Network Load Balancer (NLB) in the centralized VPC and point the target groups to the ALBs. Set up host-based routing to route application traffic to the corresponding target group through the NLB - NLB does not support host-based routing, so this option is incorrect. You should also note that NLB now supports ALB as a target type.

Configure the applications behind private Application Load Balancers (ALBs) in separate VPCs. Set up a public Network Load Balancer (NLB) in the centralized VPC and point the target groups to the private IP addresses of the ALBs. Set up host-based routing to route application traffic to the corresponding target group through the NLB - NLB does not support host-based routing, so this option is incorrect.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html

https://docs.aws.amazon.com/vpc/latest/privatelink/endpoint-services-overview.html

https://aws.amazon.com/about-aws/whats-new/2021/09/application-load-balancer-aws-privatelink-static-ip-addresses-network-load-balancer/

https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-lambda-to-enable-static-ip-addresses-for-application-load-balancers/

https://aws.amazon.com/blogs/aws/new-host-based-routing-support-for-aws-application-load-balancers/

Domain

Design Solutions for Organizational Complexity

Question 44Correct

A healthcare company has to maintain a log of all transactions for audit and compliance purposes. The company is planning stringent security measures for all of its CloudTrail log files.

Which of the following would you suggest as the LEAST effort options to secure the CloudTrail logs? (Select two)

Your selection is correct

Enable CloudTrail log file integrity validation

Your selection is correct

Use Amazon S3 MFA Delete on the S3 bucket that holds CloudTrail logs and digest files

To prevent access rights violation, use AWS root user account to manage CloudTrail logs

Enable Versioning on Amazon S3 buckets that store CloudTrail logs and digest files

Integrate with Amazon CloudWatch alarms to generate an alarm whenever changes are made to CloudTrail log files

Overall explanation

Correct options:

Enable CloudTrail log file integrity validation - Validated log files are invaluable in security and forensic investigations. For example, a validated log file enables you to assert positively that the log file itself has not changed, or that particular user credentials performed specific API activity. The CloudTrail log file integrity validation process also lets you know if a log file has been deleted or changed, or assert positively that no log files were delivered to your account during a given time.

When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file. CloudTrail signs each digest file using the private key of a public and private key pair. After delivery, you can use the public key to validate the digest file. CloudTrail uses different key pairs for each AWS region.

Use Amazon S3 MFA Delete on the S3 bucket that holds CloudTrail logs and digest files - The digest files are delivered to the same Amazon S3 bucket associated with your trail as your CloudTrail log files. If your log files are delivered from all regions or from multiple accounts into a single Amazon S3 bucket, CloudTrail will deliver the digest files from those regions and accounts into the same bucket.

Configuring multi-factor authentication (MFA) ensures that any attempt to change the versioning state of your bucket or permanently delete an object version requires additional authentication. This helps prevent any operation that could compromise the integrity of your log files, even if a user acquires the password of an IAM user that has permission to permanently delete Amazon S3 objects.

Incorrect options:

Enable Versioning on Amazon S3 buckets that store CloudTrail logs and digest files - Versioning in Amazon S3 is a means of keeping multiple variants of an object in the same bucket. You can use the S3 Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets. With versioning, you can recover from both unintended user actions and application failures. Versioning would allow you to change the logs without raising any alarm/warning/notice.

Integrate with Amazon CloudWatch alarms to generate an alarm whenever changes are made to CloudTrail log files - CloudTrail and CloudWatch are closely integrated and it is possible to implement something like this. However, this requires additional effort compared to the correct options.

To prevent access rights violation, use AWS root user account to manage CloudTrail logs - Root user account should not be used for any operational use cases as a security best practice, so this option is incorrect.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html

Domain

Design for New Solutions

Question 45Correct

A solutions architect at a retail company has configured a private hosted zone using Route 53. The architect needs to configure health checks for record sets within the private hosted zone that are associated with EC2 instances.

How can the architect build a solution to address the given use case?

Your answer is correct

Configure a CloudWatch metric that checks the status of the EC2 StatusCheckFailed metric, add an alarm to the metric, and then configure a health check that monitors the state of the alarm

Configure a CloudWatch metric that checks the status of the EC2 StatusCheckFailed metric and then configure a health check that monitors the status of the metric

Configure a Route 53 health check that monitors an SNS topic which in turn notifies a CloudWatch alarm when the EC2 StatusCheckFailed metric fails

Configure a Route 53 health check to a private IP associated with the instances inside the VPC to be checked

Overall explanation

Correct option:

Configure a CloudWatch metric that checks the status of the EC2 StatusCheckFailed metric, add an alarm to the metric, and then configure a health check that monitors the state of the alarm

A private hosted zone is a container that holds information about how you want Amazon Route 53 to respond to DNS queries for a domain and its subdomains within one or more VPCs that you create with the Amazon VPC service.

via https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html

Amazon Route 53 health checks monitor the health and performance of your web applications, web servers, and other resources. Each health check that you create can monitor one of the following:

The health of a specified resource, such as a web server.

The status of other health checks.

The status of an Amazon CloudWatch alarm.

Additionally, with Amazon Route 53 Application Recovery Controller, you can set up routing control health checks with DNS failover records to manage traffic failover for your application.

For the given use case, you need to create a CloudWatch metric that checks the status of the EC2 StatusCheckFailed metric, add an alarm to the metric, and then create a health check that is based on the data stream for the alarm. To improve resiliency and availability, Route 53 doesn't wait for the CloudWatch alarm to go into the ALARM state. The status of a health check changes from healthy to unhealthy based on the data stream and the criteria in the CloudWatch alarm.

via https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/health-checks-types.html

Incorrect options:

Configure a Route 53 health check that monitors an SNS topic which in turn notifies a CloudWatch alarm when the EC2 StatusCheckFailed metric fails - As mentioned above, the Route 53 health checks cannot monitor an SNS topic, so this option is incorrect.

Configure a Route 53 health check to a private IP associated with the instances inside the VPC to be checked - Route 53 health checkers are outside the VPC. To check the health of an endpoint within a VPC by IP address, you must assign a public IP address to the instance in the VPC. Therefore, you cannot configure a Route 53 health check to a private IP associated with an instance.

Configure a CloudWatch metric that checks the status of the EC2 StatusCheckFailed metric and then configure a health check that monitors the status of the metric - Route 53 health checks can monitor CloudWatch alarms. The Route 53 health checks cannot directly monitor the CloudWatch metrics, so this option is incorrect.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-private-hosted-zones.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/health-checks-types.html

Domain

Continuous Improvement for Existing Solutions

Question 46Correct

An analytics company runs a web service that is used by client applications deployed in multiple offices worldwide. The application architecture consists of an Elastic Load Balancer (ELB) distributing traffic across ten application servers deployed in an Auto Scaling group across two Availability Zones. The ELB uses a round-robin configuration with no sticky sessions. The development team has configured the NACLs and security groups to allow port 22 from a NAT instance being used as a jump host, and also allow port 80 from 0.0.0.0/0. The client configuration is managed by each regional IT team. The networking team has noticed that a significant number of requests from incorrectly configured client sites are causing a single application server to degrade. The remainder of the requests are equally distributed across all servers with no negative effects.

As an AWS Certified Solutions Architect Professional, what would you recommend to address the situation and prevent future occurrences?

Terminate the affected instance and allow Auto Scaling to create a new instance

Update the NACL for the application servers to only allow incoming traffic on port 80 from the ELB

Your answer is correct

Update the Security Groups for the application servers to only allow incoming traffic on port 80 from the ELB

Terminate the ELB and then create another ELB with a new target group for the ten instances

Overall explanation

Correct option:

Update the Security Groups for the application servers to only allow incoming traffic on port 80 from the ELB

A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups. For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.

For the given use case, you need to configure the security group associated with the application servers to only allow incoming traffic on port 80 from the ELB (by using the security group associated to the ELB as the source). This would stop the direct incoming traffic on port 80 from 0.0.0.0/0.

Incorrect options:

Terminate the ELB and then create a new ELB with a new target group for the ten instances - This option has been added as a distractor since the issue is with the instance directly processing incoming requests from the incorrectly configured client sites.

Update the NACL for the application servers to only allow incoming traffic on port 80 from the ELB - A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. NACLs are associated with subnets and NOT directly with instances. Further, any changes done to NACLs would affect all instances in the same subnet, so this option is not the best fit for the given use case.

Terminate the affected instance and allow Auto Scaling to create a new instance - Terminating the affected instance would not fix the issue since the incorrectly configured client sites would continue to send the requests to the replacement instance created by the Auto Scaling group.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html

Domain

Design for New Solutions

Question 47Correct

The research department at a healthcare company stores its entire data on Amazon S3. The research department is concerned about the increased costs of storing large amounts of data, most of which is in the form of images. As of now, all data is stored using the S3 Standard storage class. The research department has the following data archival requirements:

Need optimum storage for medical reports that are accessed infrequently (about twice a year). But, when accessed, the data has to be retrieved in real-time.

Need optimum storage for medical images that are accessed very rarely but have to be stored durably for up to 10 years. These images can be retrieved in a flexible time frame.

What will you recommend as the most cost-effective storage option that addresses the given requirements?

Amazon S3 Glacier Flexible Retrieval is the best fit for data accessed twice a year. Amazon S3 Glacier Deep Archive is cost-effective for data that is stored for long-term retention

Your answer is correct

Amazon S3 Glacier Instant Retrieval is the best fit for data accessed twice a year. Amazon S3 Glacier Deep Archive is cost-effective for data that is stored for long-term retention

Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering) is the best fit for data accessed twice a year. Amazon S3 Glacier is cost-effective for data that is stored for long-term retention

Amazon S3 Glacier Deep Archive alone caters to both the above-mentioned requirements

Overall explanation

Correct option:

Amazon S3 Glacier Instant Retrieval is the best fit for data accessed twice a year. Amazon S3 Glacier Deep Archive is cost-effective for data that is stored for long-term retention - Amazon S3 Glacier Instant Retrieval is an archive storage class that delivers the lowest-cost storage for long-lived data that is rarely accessed and requires retrieval in milliseconds. With S3 Glacier Instant Retrieval, you can save up to 68% on storage costs compared to using the S3 Standard-Infrequent Access (S3 Standard-IA) storage class, when your data is accessed once per quarter. S3 Glacier Instant Retrieval delivers the fastest access to archive storage, with the same throughput and milliseconds access as the S3 Standard and S3 Standard-IA storage classes.

S3 Glacier Deep Archive is Amazon S3’s lowest-cost storage class and supports long-term retention and digital preservation for data that may be accessed once or twice a year. It is designed for customers—particularly those in highly-regulated industries, such as financial services, healthcare, and public sectors—that retain data sets for 7—10 years or longer to meet regulatory compliance requirements. S3 Glacier Deep Archive can also be used for backup and disaster recovery use cases, and is a cost-effective and easy-to-manage alternative to magnetic tape systems, whether they are on-premises libraries or off-premises services.

Performance comparision between different Storage Classes:

via - https://aws.amazon.com/s3/storage-classes/

Incorrect options:

Amazon S3 Glacier Flexible Retrieval is the best fit for data accessed twice a year. Amazon S3 Glacier Deep Archive is cost-effective for data that is stored for long-term retention - S3 Glacier Flexible Retrieval delivers low-cost storage, up to 10% lower cost (than S3 Glacier Instant Retrieval), for archive data that is accessed 1—2 times per year and is retrieved asynchronously. For archive data that does not require immediate access but needs the flexibility to retrieve large sets of data at no cost, such as backup or disaster recovery use cases, S3 Glacier Flexible Retrieval (formerly S3 Glacier) is the ideal storage class.

Since the data retrieval time for S3 Glacier Flexible Retrieval is from minutes to hours, this option is not the right choice for the first requirement of the given use case.

Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering) is the best fit for data accessed twice a year. Amazon S3 Glacier is cost-effective for data that is stored for long-term retention - Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering) is the first cloud storage that automatically reduces your storage costs on a granular object level by automatically moving data to the most cost-effective access tier based on access frequency, without performance impact, retrieval fees, or operational overhead. S3 Intelligent-Tiering delivers milliseconds latency and high throughput performance for frequently, infrequently, and rarely accessed data in the Frequent, Infrequent, and Archive Instant Access tiers.

S3 Intelligent-Tiering can be used as default storage for most cases or for use cases where the data access pattern is not clear. For the given use case, the data access pattern is clear and the Amazon S3 Glacier Instant Retrieval class is more cost-effective, as discussed above.

Amazon S3 Glacier Deep Archive alone caters to both the above-mentioned requirements - S3 Glacier Deep Archive is Amazon S3’s lowest-cost storage class and supports long-term retention and digital preservation for data that may be accessed once or twice in a year. It is designed for customers—particularly those in highly-regulated industries, such as financial services, healthcare, and public sectors—that retain data sets for 7—10 years or longer to meet regulatory compliance requirements. S3 Glacier Deep Archive can also be used for backup and disaster recovery use cases, and is a cost-effective and easy-to-manage alternative to magnetic tape systems, whether they are on-premises libraries or off-premises services.

Data retrieval time for S3 Glacier Deep Archive is up to 12 hours, making it an incorrect choice for the first requirement of the given use case.

Reference:

https://aws.amazon.com/s3/storage-classes/

Domain

Accelerate Workload Migration and Modernization

Question 48Incorrect

An investment firm collects daily stock trading data from exchanges and stores it in a data warehouse. The development team at the firm needs a solution that streams data directly into the data repository but should also allow SQL-based data modifications when needed. The solution should facilitate complex analytical queries that execute in the fastest possible time. The solution should also offer a business intelligence dashboard that highlights any stock price anomalies.

Which of the following options represents the best solution for the given use case?

Configure Amazon Kinesis Data Streams to stream data to Amazon Redshift. Create a business intelligence dashboard by using Amazon QuickSight that has Amazon Redshift as a data source

Your answer is incorrect

Configure Amazon Kinesis Data Streams to stream data to Amazon S3. Create a business intelligence dashboard by using Amazon QuickSight that has Amazon Athena as a data source

Configure Amazon Kinesis Data Firehose to stream data to Amazon S3. Create a business intelligence dashboard by using Amazon QuickSight that has Amazon Athena as a data source

Correct answer

Configure Amazon Kinesis Data Firehose to stream data to Amazon Redshift. Create a business intelligence dashboard by using Amazon QuickSight that has Amazon Redshift as a data source

Overall explanation

Correct option:

Configure Amazon Kinesis Data Firehose to stream data to Amazon Redshift. Create a business intelligence dashboard by using Amazon QuickSight that has Amazon Redshift as a data source

Amazon Kinesis Data Firehose is an extract, transform, and load (ETL) service that reliably captures, transforms, and delivers streaming data to data lakes, data stores, and analytics services. It can capture, transform, and load streaming data into Amazon S3, Amazon Redshift, Amazon OpenSearch Service, and Splunk, enabling near real-time analytics with existing business intelligence tools and dashboards.

Kinesis Data Firehose Overview:

via - https://aws.amazon.com/kinesis/data-firehose/

Amazon Kinesis Data Streams is a massively scalable, highly durable data ingestion and processing service optimized for streaming data. Amazon Kinesis Data Streams is integrated with a number of AWS services, including Amazon Kinesis Data Firehose for near real-time transformation.

Key Concepts for Kinesis Data Streams:

via - https://aws.amazon.com/kinesis/data-streams/getting-started/

For the given use case, you can use Kinesis Data Firehose to stream data to Amazon Redshift. For a Redshift destination, streaming data is delivered to an S3 bucket first. Kinesis Data Firehose then issues an Amazon Redshift COPY command to load data from your S3 bucket to your Amazon Redshift cluster. If data transformation is enabled, you can optionally back up source data to another Amazon S3 bucket. Once the data is in Redshift, you can use Quicksight to create a business intelligence dashboard that has Redshift as the data source.

via - https://docs.aws.amazon.com/firehose/latest/dev/what-is-this-service.html

Incorrect options:

Configure Amazon Kinesis Data Streams to stream data to Amazon Redshift. Create a business intelligence dashboard by using Amazon QuickSight that has Amazon Redshift as a data source

You cannot stream data from Kinesis Data Streams directly to Redshift. You need to use Kinesis Data Firehose to deliver streaming data to Redshift. So this option is incorrect.

Configure Amazon Kinesis Data Firehose to stream data to Amazon S3. Create a business intelligence dashboard by using Amazon QuickSight that has Amazon Athena as a data source

Configure Amazon Kinesis Data Streams to stream data to Amazon S3. Create a business intelligence dashboard by using Amazon QuickSight that has Amazon Athena as a data source

Storing the data in S3 and then querying the data via Athena would not facilitate the execution of complex queries in the fastest possible time since Redshift has much better performance than Athena for complex analytical queries. So both these options are incorrect.

References:

https://aws.amazon.com/kinesis/data-firehose/

https://aws.amazon.com/kinesis/data-streams/getting-started/

https://aws.amazon.com/premiumsupport/knowledge-center/quicksight-redshift-private-connection/

Domain

Design for New Solutions

Question 49Correct

A web application is hosted on Amazon EC2 instances that are fronted by Application Load Balancer (ALB) configured with an Auto Scaling group (ASG). Enhanced security is provided to the ALB by AWS WAF web ACLs. As per the company's security policy, AWS CloudTrail is activated and logs are configured to be stored on Amazon S3 and CloudWatch Logs.

A holiday sales offer was run on the application for a week. The development team has noticed that a few of the instances have rebooted taking down the log files and all temporary data with them. Initial analysis has confirmed that the incident took place during off-peak hours. Even though the incident did not cause any sales or revenue loss, the CTO has asked the development team to fix the security error that has allowed the incident to go unnoticed and eventually untraceable.

Which of the following steps will you implement to permanently record all traffic coming into the application?

To capture information about the IP traffic going to and from network interfaces, configure VPC Flow Logs to be directly streamed to Kinesis Data Streams and create alarms for automatic monitoring

Your answer is correct

Configure the WAF web ACL to deliver logs to Amazon Kinesis Data Firehose, which should be configured to eventually store the logs in an Amazon S3 bucket. Use Athena to query the logs for errors and tracking

Configure Elastic Load Balancing to write access logs to Amazon Kinesis Data Firehose. The logs can be further directed from Firehose into an Amazon S3 bucket for further analysis and reporting

Configure the WAF web ACL to deliver logs to Amazon CloudTrail and create a trail that applies to all Regions. This delivers log files from all Regions to an S3 bucket. Use Athena to query the logs for errors and tracking

Overall explanation

Correct option:

Configure the WAF web ACL to deliver logs to Amazon Kinesis Data Firehose, which should be configured to eventually store the logs in an Amazon S3 bucket. Use Athena to query the logs for errors and tracking

The logging destinations that you can choose from for your AWS WAF logs are:

Amazon CloudWatch Logs

Amazon Simple Storage Service

Amazon Kinesis Data Firehose

To send logs to Amazon Kinesis Data Firehose, you send logs from your web ACL to an Amazon Kinesis Data Firehose with a configured storage destination. After you enable logging, AWS WAF delivers logs to your storage destination through the HTTPS endpoint of Kinesis Data Firehose.

One AWS WAF log is equivalent to one Kinesis Data Firehose record. If you typically receive 10,000 requests per second and you enable full logs, you should have 10,000 records per second setting in Kinesis Data Firehose.

Incorrect options:

Configure the WAF web ACL to deliver logs to Amazon CloudTrail and create a trail that applies to all Regions. This delivers log files from all Regions to an S3 bucket. Use Athena to query the logs for errors and tracking - As discussed above, the logging destinations that you can choose from for your AWS WAF logs are Amazon CloudWatch Logs, Amazon Simple Storage Service, and Amazon Kinesis Data Firehose. Amazon CloudTrail is not a valid destination for WAF ACL logs.

To capture information about the IP traffic going to and from network interfaces, configure VPC Flow Logs to be directly streamed to Kinesis Data Streams and create alarms for automatic monitoring - VPC Flow You should also note that VPC Flow Logs cannot capture all traffic coming into the application as these can only capture information about the IP traffic going to and from network interfaces in your VPC. In addition, VPC Flow Logs can be directly published only to the following destinations: Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose. So this option is incorrect.

Configure Elastic Load Balancing to write access logs to Amazon Kinesis Data Firehose. The logs can be further directed from Firehose into an Amazon S3 bucket for further analysis and reporting - Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer. Elastic Load Balancing access logs are stored in Amazon S3 buckets and it is not possible to directly write the logs to Kinesis Data Firehose.

References:

https://aws.amazon.com/about-aws/whats-new/2021/12/awf-waf-cloudwatch-log-s3-bucket/

https://docs.aws.amazon.com/waf/latest/developerguide/logging-destinations.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

Domain

Continuous Improvement for Existing Solutions

Question 50Correct

A company wants to migrate its on-premises resources to AWS. The IT environment consists of 200 virtual machines (VMs) with a combined storage capacity of 50 TB. While the majority of VMs may be taken down for migration since they are only used during business hours, others are mission-critical, so the downtime must be minimized. The on-premises network engineer has allocated 10 Mbps of internet bandwidth for the migration. The capacity of the on-premises network has peaked and increasing it would be prohibitively expensive.

You have been hired as an AWS Certified Solutions Architect Professional to develop a migration strategy that can be implemented in the next three months. Which of the following would you recommend?

Your answer is correct

Migrate mission-critical VMs using AWS Application Migration Service (MGN). Export the other VMs locally and transfer them to Amazon S3 using AWS Snowball Edge. Leverage VM Import/Export to import the VMs into Amazon EC2

Leverage AWS Migration Hub to analyze each application for further refactoring and optimizations using AWS services or AWS Marketplace solutions

Export the VMs locally, starting with the most mission-critical servers first. Configure a 1.25 Gbps AWS site-to-site VPN to securely upload each VM to Amazon S3 after they are exported. Use VM Import/Export to import the VMs into Amazon EC2

Create a 10 Gbps AWS Direct Connect connection and then configure a private virtual interface. Leverage AWS Server Migration Service (SMS) to migrate the VMs into Amazon EC2

Overall explanation

Correct option:

Migrate mission-critical VMs using AWS Application Migration Service (MGN). Export the other VMs locally and transfer them to Amazon S3 using AWS Snowball Edge. Leverage VM Import/Export to import the VMs into Amazon EC2

AWS Application Migration Service (MGN) simplifies and expedites your migration to AWS by automatically converting your source servers from physical, virtual, or cloud infrastructure to run natively on AWS. It further simplifies your migration and reduces costs by enabling you to use the same automated process for a wide range of applications, without changes to applications, their architecture, or the migrated servers. You can use AWS Application Migration Service to perform non-disruptive tests before cutover. After testing, you can use AWS Application Migration Service to quickly lift and shift your applications to the cloud during a short cutover window, typically measured in minutes.

Application Migration Service:

via - https://aws.amazon.com/application-migration-service/

Snowball Edge Storage Optimized is the optimal choice if you need to securely and quickly transfer dozens of terabytes to petabytes of data to AWS. It provides up to 80 TB of usable HDD storage, 40 vCPUs, 1 TB of SATA SSD storage, and up to 40 Gb network connectivity to address large-scale data transfer and pre-processing use cases. As each Snowball Edge Storage Optimized device can handle 80 TB of data, you can order 1 such device to take care of the data transfer for all applications. AWS Snowball Edge is suitable for offline data transfers, for customers who are bandwidth constrained or transferring data from remote, disconnected, or austere environments.

You can use VM Import/Export to import virtual machine (VM) images from your virtualization environment to Amazon EC2 as Amazon Machine Images (AMI), which you can use to launch instances. Subsequently, you can export the VM images from an instance back to your virtualization environment.

For the given use case, you can migrate mission-critical VMs using AWS Application Migration Service (MGN) as the limited bandwidth of 10 Mbps would be able to support this migration of the most critical VMs without any significant downtime. You can then export the other non-critical VMs locally by copying the VM images into the AWS Snowball Edge device which is later transferred to Amazon S3. Lastly, you can use the VM Import/Export to import the VM images from S3 into Amazon EC2.

Incorrect options:

Create a 10 Gbps AWS Direct Connect connection and then configure a private virtual interface. Leverage AWS Server Migration Service (SMS) to migrate the VMs into Amazon EC2

AWS Direct Connect links your on-premises data center to an AWS Direct Connect location over a standard Ethernet fiber-optic cable. One end of the cable is connected to your router, the other to an AWS Direct Connect router. With this connection, you can create virtual interfaces directly to public AWS services (for example, to Amazon S3) or Amazon VPC, bypassing internet service providers in your network path. An AWS Direct Connect location provides access to AWS in the Region with which it is associated.

via - https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

Given that the capacity for the on-premises network has peaked and only 10 Mbps of internet bandwidth is available for the migration task, therefore provisioning a 10 Gbps Direct Connect connection will not help as the constraint of 10 Mbps persists for the on-premises network. At this max bandwidth of 10 Mbps, you can only migrate 106060*24 = 864000 Mb or 864 MB or approx 1 GB of data per day. This is not sufficient to transfer 50 TB of data within the stipulated time of 3 months. Hence this option is incorrect.

Leverage AWS Migration Hub to analyze each application for further refactoring and optimizations using AWS services or AWS Marketplace solutions - AWS Migration Hub provides a single place to store IT asset inventory data while tracking migrations to any AWS Region. It simplifies the discovery of existing applications and infrastructure and their dependencies, assessment of an application’s ability to be migrated and modernized, and recommendations for modernization strategies. Given that the IT environment consists of 200 virtual machines (VMs), it is not feasible to refactor all applications running on these VMs to use AWS services within the stipulated timeframe of three months. Hence this option is not the right fit.

AWS Migration Hub:

via - https://aws.amazon.com/migration-hub/

Export the VMs locally, starting with the most mission-critical servers first. Configure a 1.25 Gbps AWS site-to-site VPN to securely upload each VM to Amazon S3 after they are exported. Use VM Import/Export to import the VMs into Amazon EC2 - AWS Site-to-Site VPN enables you to securely connect your on-premises network or branch office site to your Amazon Virtual Private Cloud (Amazon VPC). You can securely extend your data center or branch office network to the cloud with an AWS Site-to-Site VPN connection. AWS Site-to-Site VPN supports throughput up to 1.25 Gbps, although the actual throughput can be lower for VPN connections that are in different geolocations from the AWS region. This is because the internet path between them has to traverse multiple networks.

Given that the capacity for the on-premises network has peaked and only 10 Mbps of internet bandwidth is available for the migration task, therefore provisioning a 1.25 Gbps AWS site-to-site VPN connection will not help as the constraint of 10 Mbps persists for the on-premises network. At this max bandwidth of 10 Mbps, you can only migrate 106060*24 = 864000 Mb or 864 MB or approx 1 GB of data per day. This is not sufficient to transfer 50 TB of data within the stipulated time of 3 months. Hence this option is incorrect.

References:

https://aws.amazon.com/application-migration-service/

https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html

https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

https://aws.amazon.com/blogs/architecture/improve-vpn-network-performance-of-aws-hybrid-cloud-with-global-accelerator/

Domain

Accelerate Workload Migration and Modernization

Question 51Incorrect

A solutions architect has configured an Amazon Relational Database Service (Amazon RDS) DB instance as part of an AWS Elastic Beanstalk environment. To resolve an issue, the Beanstalk environment has to be upgraded from environment A to environment B for a week. Therefore, the dependency between the DB instance and the Beanstalk environment has to be removed.

How will you implement this requirement without causing a downtime and data loss?

Use AWS CloudFormation to set up a blue (environment A)/green (environment B) deployment for decoupling the RDS DB instance from the Beanstalk environment (environment A)

Use an Elastic Beanstalk rolling deployment policy to decouple the RDS DB instance from the Beanstalk environment (environment A)

Correct answer

Decouple the RDS DB instance from the Beanstalk environment (environment A) and leverage Elastic Beanstalk blue (environment A)/green (environment B) deployment to connect to the decoupled database post the upgrade

Your answer is incorrect

Use AWS CodeDeploy to manage blue (environment A)/green (environment B) deployment to decouple the RDS DB instance from the Beanstalk environment (environment A)

Overall explanation

Correct option:

Decouple the RDS DB instance from the Beanstalk environment (environment A) and leverage Elastic Beanstalk blue (environment A)/green (environment B) deployment to connect to the decoupled database post the upgrade - Because AWS Elastic Beanstalk performs an in-place update when you update your application versions, your application might become unavailable to users for a short time. To avoid this, perform a blue/green deployment. To do this, deploy the new version to a separate environment, and then swap the CNAMEs of the two environments to redirect traffic to the new version instantly.

Attaching an RDS DB instance to an Elastic Beanstalk environment is ideal for development and testing environments. However, it's not recommended for production environments because the lifecycle of the database instance is tied to the lifecycle of your application environment. If you terminate the environment, then you lose your data because the RDS DB instance is deleted by the environment. You have the option to decouple the database from your Elastic Beanstalk environment (by using the console or the configuration files) to move towards a configuration that offers greater flexibility. The decoupled database can remain operational as an external Amazon RDS database instance.

The following deletion policies apply to a database after you decouple it from an Elastic Beanstalk environment or terminate the Elastic Beanstalk environment.

Snapshot — Before Elastic Beanstalk terminates the database, it saves a snapshot of it.

Delete — Elastic Beanstalk terminates the database. After it's terminated, the database instance is no longer available for any operation.

Retain — The database instance isn't terminated. It remains available and operational, though decoupled from Elastic Beanstalk. You can then configure one or multiple environments to connect to the database as an external Amazon RDS database instance.

The following steps have to be followed to meet the given requirements:

Decouple the RDS DB instance from environment A and set up an Elastic Beanstalk blue (environment A)/green (environment B) deployment.

Create a new Elastic Beanstalk environment (environment B) with the necessary information to connect to the decoupled RDS DB instance.

Swap the CNAMEs of the two environments to redirect traffic to the new version instantly.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.db.html#environments-cfg-rds-lifecycle

Incorrect options:

Use AWS CloudFormation to set up a blue (environment A)/green (environment B) deployment for decoupling the RDS DB instance from the Beanstalk environment (environment A) - AWS CloudFormation is a convenient provisioning mechanism for a broad range of AWS and third-party resources. It supports the infrastructure needs of many different types of applications such as existing enterprise applications, legacy applications, applications built using a variety of AWS resources, and container-based solutions (including those built using AWS Elastic Beanstalk).

AWS CloudFormation supports Elastic Beanstalk application environments as one of the AWS resource types. This allows you, for example, to create and manage an AWS Elastic Beanstalk–hosted application along with an RDS database to store the application data. Any other supported AWS resource can be added to the group as well. You cannot use CloudFormation to decouple an RDS DB instance from the Beanstalk environment.

Use AWS CodeDeploy to manage blue (environment A)/green (environment B) deployment to decouple the RDS DB instance from the Beanstalk environment (environment A) - AWS CodeDeploy is a service that automates code deployments to any instance, including Amazon EC2 instances and instances running on-premises. AWS CodeDeploy makes it easier for you to rapidly release new features, helps you avoid downtime during deployment, and handles the complexity of updating your applications. Depending on the use case, CodeDeploy can be used as an alternative for AWS Elastic Beanstalk, however, both cannot be used together. Therefore this option just acts as a distractor.

Use an Elastic Beanstalk rolling deployment policy to decouple the RDS DB instance from the Beanstalk environment (environment A) - AWS Elastic Beanstalk provides several options for how deployments are processed, including deployment policies (All at once, Rolling, Rolling with additional batch, Immutable, and Traffic splitting) and options that let you configure the batch size and health check behavior during deployments.

With rolling deployments, Elastic Beanstalk splits the environment's Amazon EC2 instances into batches and deploys the new version of the application to one batch at a time. It leaves the rest of the instances in the environment running the old version of the application. During a rolling deployment, some instances serve requests with the old version of the application, while instances in completed batches serve other requests with the new version. You cannot use the Elastic Beanstalk rolling deployment policy to decouple the RDS DB instance from the Beanstalk environment (environment A).

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.CNAMESwap.html

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.db.html#environments-cfg-rds-lifecycle

https://aws.amazon.com/cloudformation/faqs/

Domain

Design Solutions for Organizational Complexity

Question 52Correct

A company wants to use AWS Organizations to set up Service control policies (SCPs) for better control over AWS resources used by the teams. The policy should allow access to describe actions on Amazon EC2 instances while denying access to all actions on Amazon S3 buckets.

Which of the following is the correct option to include both the requirements into a single SCP?

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow,Deny",
"Action": "ec2:Describe*","s3:*"
"Resource":" *"
}
]
}

{
"Version": "2012-10-17",
"Statement":
{
"Effect":"Allow",
"Action":"ec2:Describe*",
"Resource":"*"
}
}
{
"Statement": {
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*"
}
}

{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
"Statement": {
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*"
}
}

Your answer is correct

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource":" *"
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*"
}
]
}

Overall explanation

Correct option:

**

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource":" *"
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*"
}
]
}

** - An SCP must consist of one and only one JSON object. You denote an object by placing { } braces around it. Although you can nest other objects within a JSON object by embedding additional { } braces within the outer pair, a policy can contain only one outermost pair of { } braces. The value of the Statement element is an object array. The array in the example consists of two objects, each of which is a correct value for a Statement element. Each object in the array is separated by commas.

Incorrect options:

**

{
"Version": "2012-10-17",
"Statement":
{
"Effect":"Allow",
"Action":"ec2:Describe*",
"Resource":"*"
}
}
{
"Statement": {
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*"
}
}

** - An SCP must consist of one and only one JSON object. You denote an object by placing { } braces around it. Two objects in a single SCP are not allowed.

**

{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
"Statement": {
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*"
}
}

** - An SCP must contain only one Statement element, consisting of the name (Statement) appearing to the left of a colon, followed by its value on the right. Instead of including two complete policy objects, each with its Statement element, you can combine the two blocks into a single Statement element.

**

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow,Deny",
"Action": "ec2:Describe*","s3:*"
"Resource":" *"
}
]
}

** - This policy cannot be compressed into a Statement with one element because the two elements have different effects. Generally, you can combine statements only when the Effect and Resource elements in each statement are identical.

Reference:

https://docs.aws.amazon.com/organizations/latest/userguide/org_troubleshoot_policies.html

Domain

Design for New Solutions

Question 53Correct

A retail company has a Direct Connect connection between its on-premises data center and its VPC on the AWS Cloud. The company's flagship application runs on an EC2 instance in the VPC and it needs to access customer data stored in the on-premises data center with consistent performance. To meet the compliance guidelines, the data should remain encrypted during this operation.

Which of the following solutions would you recommend for this use case?

Configure a transit virtual interface on the Direct Connect connection. Create an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC

Configure a public virtual interface on the Direct Connect connection. Create an AWS Site-to-Site VPN between the customer gateway and the virtual public gateway in the VPC

Your answer is correct

Configure a public virtual interface on the Direct Connect connection. Create an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC

Configure a private virtual interface on the Direct Connect connection. Create an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC

Overall explanation

Correct option:

Configure a public virtual interface on the Direct Connect connection. Create an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC

AWS Direct Connect is a networking service that provides an alternative to using the internet to connect to AWS. Using Direct Connect, data that would have previously been transported over the internet is delivered through a private network connection between your facilities and AWS

AWS Direct Connect (DX) provides three types of virtual interfaces - public, private, and transit.

Private virtual interface: A private virtual interface should be used to access an Amazon VPC using private IP addresses.

Public virtual interface: A public virtual interface can access all AWS public services using public IP addresses.

Transit virtual interface: A transit virtual interface should be used to access one or more Amazon VPC Transit Gateways associated with Direct Connect gateways. You can use transit virtual interfaces with 1/2/5/10 Gbps AWS Direct Connect connections.

Direct Connect Virtual Interfaces:

via - https://aws.amazon.com/premiumsupport/knowledge-center/public-private-interface-dx/

By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection.

via - https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

You can combine AWS Direct Connect dedicated network connections with the Amazon VPC VPN. AWS Direct Connect public VIF can be used to establish a dedicated network connection between your network to public AWS resources, such as an Amazon virtual private gateway IPsec endpoint. This solution combines the benefits of the end-to-end secure IPSec connection with low latency and increased bandwidth of the AWS Direct Connect to provide a more consistent network experience than internet-based VPN connections.

via https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-vpn.html

Incorrect options:

Configure a private virtual interface on the Direct Connect connection. Create an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC - You cannot use a private VIF on the Direct Connect connection to create an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway.

Configure a transit virtual interface on the Direct Connect connection. Create an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC - You cannot use a transit VIF on the Direct Connect connection to create an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway.

Configure a public virtual interface on the Direct Connect connection. Create an AWS Site-to-Site VPN between the customer gateway and the virtual public gateway in the VPC - There is no such thing as a virtual public gateway. This option has been added as a distractor.

References:

https://docs.aws.amazon.com/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.html

https://aws.amazon.com/premiumsupport/knowledge-center/public-private-interface-dx/

https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-vpn.html

Domain

Design for New Solutions

Question 54Correct

A social media company is migrating its legacy web application to the AWS Cloud. Since the application is complex and may take several months to refactor, the CTO at the company tasked the development team to build an ad-hoc solution of using CloudFront with a custom origin pointing to the SSL endpoint URL for the legacy web application until the replacement is ready and deployed. The ad-hoc solution has worked for several weeks, however, all browser connections recently began showing an HTTP 502 Bad Gateway error with the header "X-Cache: Error from CloudFront". Network monitoring services show that the HTTPS port 443 on the legacy web application is open and responding to requests.

As an AWS Certified Solutions Architect Professional, which of the following options will you attribute as the likely cause of the error, and what is your recommendation to resolve this issue?

The SSL certificate on the legacy web application server has expired. Reissue the SSL certificate on the web server via the AWS Certificate Manager (ACM) in the us-east-1 Region

The SSL certificate on the CloudFront distribution has expired. Reissue the SSL certificate on the CloudFront distribution via the AWS Certificate Manager (ACM) in the us-east-1 Region

Your answer is correct

The SSL certificate on the legacy web application server has expired. Reissue the SSL certificate on the web server that is signed by a globally recognized certificate authority (CA). Install the full certificate chain onto the legacy web application server

The SSL certificate on the legacy web application server has expired. Install a new self-signed certificate along with the full certificate chain onto the legacy web application server

Overall explanation

Correct option:

The SSL certificate on the legacy web application server has expired. Reissue the SSL certificate on the web server that is signed by a globally recognized certificate authority (CA). Install the full certificate chain onto the legacy web application server

To require HTTPS between CloudFront and your custom origin, such as the legacy web server mentioned in the given use case, you must use a certificate that is signed by a trusted third-party certificate authority (CA), for example, Comodo, DigiCert, or Symantec. When CloudFront uses HTTPS to communicate with your origin, CloudFront verifies that the certificate was issued by a trusted certificate authority. CloudFront supports the same certificate authorities that Mozilla does. If the origin server returns an expired certificate, an invalid certificate, or a self-signed certificate, or if the origin server returns the certificate chain in the wrong order, CloudFront drops the TCP connection, returns HTTP status code 502 (Bad Gateway), and sets the X-Cache header to Error from CloudFront.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-howdoesitwork.html

Incorrect options:

The SSL certificate on the legacy web application server has expired. Install a new self-signed certificate along with the full certificate chain onto the legacy web application server - A self-signed certificate is a security certificate that is not signed by a certificate authority (CA). You can't use a self-signed certificate for HTTPS communication between CloudFront and your origin, so this option is incorrect.

The SSL certificate on the CloudFront distribution has expired. Reissue the SSL certificate on the CloudFront distribution via the AWS Certificate Manager (ACM) in the us-east-1 Region - If you’re using certificates that you get from a third-party certificate authority (CA), you must monitor certificate expiration dates and renew the certificates that you import into AWS Certificate Manager (ACM) or upload to the AWS Identity and Access Management certificate store before they expire. This option has been added as a distractor, since ACM manages certificate renewals for you, if you’re using ACM-provided certificates.

The SSL certificate on the legacy web application server has expired. Reissue the SSL certificate on the web server via the AWS Certificate Manager (ACM) in the us-east-1 Region - You can't export an Amazon Issued ACM public certificate for use on an EC2 instance or another custom web server because ACM manages the private key.

References:

https://docs.amazonaws.cn/en_us/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-custom-origin.html

https://aws.amazon.com/premiumsupport/knowledge-center/configure-acm-certificates-ec2/

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html#https-requirements-cert-expiration

Domain

Accelerate Workload Migration and Modernization

Question 55Correct

A data analytics company runs a real-time data processing application that uses Kinesis Client Library (KCL) to help consume and process data from the real-time data streams. The development team has raised a query on the viability of using the same DynamoDB table for different KCL applications.

Which of the following are correct statements for KCL while consuming Kinesis Data Streams? (Select two)

Your selection is correct

Each KCL application must use its own DynamoDB table

Amazon Relational Database Service (Amazon RDS) can also be used for checkpointing KCL

Multiple KCL applications can share a DynamoDB table

Multiple KCL applications can share a DynamoDB table if Amazon Amazon Simple Storage Service (Amazon S3) is configured to save transit data and metadata

Your selection is correct

You can only use DynamoDB for checkpointing KCL

Overall explanation

Correct options:

Each KCL application must use its own DynamoDB table

Users can't use different KCL applications with the same DynamoDB table for the following reasons:

Scan operations are used to obtain leases from a DynamoDB table. Therefore, if a table contains leases of different KCL applications, each application could receive a lease that isn't related to the application itself.

Shard IDs in streams are used as primary keys in DynamoDB tables during checkpointing. When different KCL applications use the same DynamoDB table and the same shard IDs are used in the streams, inconsistencies in checkpoints can occur.

You can only use DynamoDB for checkpointing KCL - Users can only use DynamoDB as a checkpointing table for the KCL. A DynamoDB table is required as a checkpointing table for the KCL because the KCL behavior and implementation are interconnected with DynamoDB in the following ways:

The KCL includes ShardSyncTask.java, which guarantees that shard leases in a stream are included in the DynamoDB table. This check is conducted periodically in the KCL.

The KCL includes DynamoDBLeaseTaker.java and DynamoDBLeaseRenewer.java, which are components that manage and update leases in the KCL. DynamoDBLeaseTaker.java and DynamoDBLeaseRenewer.java work with DynamoDBLeaseRefresher.java to make frequent API requests to DynamoDB.

When the KCL makes checkpoints, requests from DynamoDBCheckpointer.java and DynamoDBLeaseCoordinator.java are made to DynamoDB.

Incorrect options:

Multiple KCL applications can share a DynamoDB table

Amazon Relational Database Service (Amazon RDS) can also be used for checkpointing KCL

Multiple KCL applications can share a DynamoDB table if Amazon Amazon Simple Storage Service (Amazon S3) is configured to save transit data and metadata

These three options are incorrect. Since each KCL application must use its own DynamoDB table and only DynamoDB can be used for checkpointing KCL.

Reference:

https://aws.amazon.com/premiumsupport/knowledge-center/kinesis-kcl-apps-dynamodb-table/

Domain

Design for New Solutions

Question 56Correct

A payment service provider company has a legacy application built on high throughput and resilient queueing system to send messages to the customers. The implementation relied on a manually-managed RabbitMQ cluster and consumers. The system was able to process a large load of messages within a reasonable delivery time. The cluster and consumers were both deployed on Amazon Elastic Compute Cloud (Amazon EC2) instances. However, when the messages in the queue piled up due to network failures on the customer side, the latency of the overall flow was affected, resulting in a breach of the service level agreement (SLA). The development team had to manually scale the queues to resolve the issue. Also, while doing manual upgrades on RabbitMQ and the hosting operating system, the company faced downtimes.

The company is growing and has to maintain a strict delivery time SLA. The company is now looking for a serverless solution for its messaging queues. The queue functions of handling concurrency, message delays and retries, maintaining message order, secure delivery, and scalability are needed in the proposed solution architecture.

Which of the following would you propose for a cost-effective solution for the requirement?

Design a cost-effective, serverless architecture by use of Amazon Simple Queue Service (SQS) with Amazon ECS Classic

Design the serverless architecture by use of Amazon MQ for RabbitMQ with Amazon ECS Fargate. To save costs, run the Amazon MQ for RabbitMQ queues and Amazon ECS Fargate tasks only when needed

Design the serverless architecture by use of Amazon MQ for RabbitMQ with Amazon ECS Classic

Your answer is correct

Design the serverless architecture by use of Amazon Simple Queue Service (SQS) with Amazon ECS Fargate. To save costs, run the Amazon SQS FIFO queues and Amazon ECS Fargate tasks only when needed

Overall explanation

Correct option:

Design the serverless architecture by use of Amazon Simple Queue Service (SQS) with Amazon ECS Fargate. To save costs, run the Amazon SQS FIFO queues and Amazon ECS Fargate tasks only when needed - Amazon Simple Queue Service (SQS) with Amazon ECS Fargate offers the serverless solution that the company is looking for. This solution is correct for the following reasons:

While doing manual upgrades on RabbitMQ and the hosting operating system, the company sometimes faced downtimes. By using Amazon SQS, messaging infrastructure became automated, reducing the need for maintenance operations.

To save costs, Amazon SQS FIFO queues and Amazon ECS Fargate tasks run only when needed. These services process data in smaller units and run them in parallel. They can scale up efficiently to handle peak traffic loads. This will satisfy most architectures that handle non-uniform traffic without needing additional application logic.

Migrating a self-managed message broker to Amazon SQS:

via - https://aws.amazon.com/blogs/architecture/migrating-a-self-managed-message-broker-to-amazon-sqs/

Incorrect options:

Design the serverless architecture by use of Amazon MQ for RabbitMQ with Amazon ECS Classic

Design the serverless architecture by use of Amazon MQ for RabbitMQ with Amazon ECS Fargate. To save costs, run the Amazon MQ for RabbitMQ queues and Amazon ECS Fargate tasks only when needed

Design a cost-effective, serverless architecture by use of Amazon Simple Queue Service (SQS) with Amazon ECS Classic

None of the above three solutions come under serverless options since Amazon MQ for RabbitMQ will require configuring and scaling of Amazon MQ broker. A broker is a message broker environment running on Amazon MQ. It is the basic building block of Amazon MQ. The combined description of the broker instance class (m5, t3) and size (large, micro) is a broker instance type (for example, mq.m5.large).

ECS Classic uses Amazon EC2 instances, making it unsuitable for a serverless requirement.

References:

https://aws.amazon.com/blogs/architecture/migrating-a-self-managed-message-broker-to-amazon-sqs/

https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/getting-started-rabbitmq.html

Domain

Accelerate Workload Migration and Modernization

Question 57Incorrect

A company has decided to move their existing data warehouse solution to Amazon Redshift. Being apprehensive about moving their critical data directly, the company has decided to test run and migrate a part of their data warehouse to Amazon Redshift using AWS Database Migration Service (DMS) task.

As a solutions architect, which of the following would you suggest as the key points of consideration while running the DMS task? (Select two)

Your selection is correct

Your Amazon Redshift cluster must be in the same account and same AWS Region as the replication instance

DMS now supports custom DNS names along with Amazon provided DNS names

Your selection is incorrect

AWS DMS creates the required IAM roles and policies automatically

If you need S3 versioning, enable versioning for the S3 bucket you use as intermediate storage, before the DMS task begins

Correct selection

Add subnet CIDR range, or IP address of the replication instance in the inbound rules of the Amazon Redshift cluster security group

Overall explanation

Correct options:

Your Amazon Redshift cluster must be in the same account and same AWS Region as the replication instance

When you migrate to Amazon Redshift, AWS DMS first moves the data to an Amazon Simple Storage Service (Amazon S3) bucket. Then, the data is transferred to the tables in the target Amazon Redshift cluster. This S3 bucket is created in the same AWS Region as Amazon Redshift database. For this reason, your Amazon Redshift cluster must be in the same account and same AWS Region as the replication instance.

Add subnet CIDR range, or IP address of the replication instance in the inbound rules of the Amazon Redshift cluster security group

When you provision an Amazon Redshift cluster, it is locked down by default so nobody has access to it. To grant other users inbound access to an Amazon Redshift cluster, you associate the cluster with a security group. If you are on the EC2-VPC platform, you can either use an existing Amazon VPC security group or define a new one and then associate it with a cluster. Therefore, before you begin the DMS task, you should be sure to provide the security group, subnet CIDR range, or IP address of the replication instance in the inbound rules of the Amazon Redshift cluster security group.

Limitations on using Amazon Redshift as a target for AWS Database Migration Service:

via - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redshift.html#CHAP_Target.Redshift.Limitations

Incorrect options:

DMS now supports custom DNS names along with Amazon provided DNS names - DMS doesn't support custom DNS names when configuring an endpoint for a Redshift cluster, and you need to use the Amazon provided DNS name. Since the Amazon Redshift cluster must be in the same AWS account and Region as the replication instance, validation fails if you use a custom DNS endpoint.

If you need S3 versioning, enable versioning for the S3 bucket you use as intermediate storage, before the DMS task begins - Don’t enable versioning for the S3 bucket you use as intermediate storage for your Amazon Redshift target. If you need S3 versioning, use lifecycle policies to actively delete old versions. Otherwise, you might encounter endpoint test connection failures because of an S3 list-object call timeout.

AWS DMS creates the required IAM roles and policies automatically - If you use the AWS DMS console to create the endpoint, then DMS creates the required IAM roles and policies automatically. If you use the AWS Command Line Interface (AWS CLI) or the AWS DMS API, you must create the IAM roles and policies manually.

References:

https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redshift.html#CHAP_Target.Redshift.Limitations

https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-security-groups.html

Domain

Accelerate Workload Migration and Modernization

Question 58Incorrect

A business has their web application hosted in us-east-1 region. Recently, the business has added another region us-east-2, and has configured Route53 to direct user traffic to the least-latency AWS Region. However, the development team has found some aberrations in the expected functionality and the team is trying to ascertain if it's a configuration issue.

Which of the following would you suggest as the key points of consideration while configuring Route53? (Select three)

Your selection is correct

After a Route 53 health checker receives the HTTP status code, it must receive the response body from the endpoint within the next two seconds with the SearchString string that you specified. The string must appear entirely in the first 5,120 bytes of the response body or the endpoint fails the health check

Route 53 aggregates the data from the health checkers and if more than 80% of health checkers report that an endpoint is healthy, Route 53 considers it healthy

If you specify the endpoint by domain name, Route 53 uses both the formats IPv6 and IPv4 to send health checks to the endpoint

Correct selection

If you configure Route 53 to use the HTTPS protocol to check the health of your endpoint, then that endpoint must support TLS

Your selection is correct

HTTPS health checks don't validate SSL/TLS certificates, so checks don't fail if a certificate is invalid or expired

Your selection is incorrect

If you specify a non-AWS endpoint, an additional charge applies. Charges for a health check do not apply when the health check is disabled

Overall explanation

Correct options:

HTTPS health checks don't validate SSL/TLS certificates, so checks don't fail if a certificate is invalid or expired - Route 53 must be able to establish a TCP connection with the endpoint within four seconds. In addition, the endpoint must respond with an HTTP status code of 2xx or 3xx within two seconds after connecting. HTTPS health checks don't validate SSL/TLS certificates, so checks don't fail if a certificate is invalid or expired.

If you configure Route 53 to use the HTTPS protocol to check the health of your endpoint, then that endpoint must support TLS - If you choose HTTPS, the endpoint must support TLS v1.0 or later. Also, if you choose HTTPS for the value of Protocol in Route53 configuration, an additional charge applies.

After a Route 53 health checker receives the HTTP status code, it must receive the response body from the endpoint within the next two seconds with the SearchString string that you specified. The string must appear entirely in the first 5,120 bytes of the response body or the endpoint fails the health check - Whether you want Route 53 to determine the health of an endpoint by submitting an HTTP or HTTPS request to the endpoint and searching the response body for a specified string. If the response body contains the value that you specify in the Search string, Route 53 considers the endpoint healthy. If not, or if the endpoint doesn't respond, Route 53 considers the endpoint unhealthy. The search string must appear entirely within the first 5,120 bytes of the response body.

After you create a health check, you can't change the value of String matching. If you choose Yes for the value of String matching, an additional charge applies.

Incorrect options:

If you specify the endpoint by domain name, Route 53 uses both the formats IPv6 and IPv4 to send health checks to the endpoint - If you specify the endpoint by domain name, Route 53 uses only IPv4 to send health checks to the endpoint.

If you specify a non-AWS endpoint, an additional charge applies. Charges for a health check do not apply when the health check is disabled - If you specify a non-AWS endpoint, an additional charge applies. Charges for a health check apply even when the health check is disabled.

Route 53 aggregates the data from the health checkers and if more than 80% of health checkers report that an endpoint is healthy, Route 53 considers it healthy - Route 53 aggregates the data from the health checkers, and if more than 18% of health checkers report that an endpoint is healthy, Route 53 considers it healthy.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-determining-health-of-endpoints.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/health-checks-creating-values.html

Domain

Design for New Solutions

Question 59Correct

An e-commerce company has its flagship application hosted on Amazon EC2 instances that are configured in an Auto Scaling group behind a public-facing Application Load Balancer (ALB). The application should only be accessible to users from a specific country. The company also needs the ability to monitor any prohibited requests for further analysis by the security team.

What will you suggest as the most optimal and low-maintenance solution for the given use case?

Your answer is correct

Set up an AWS Web Application Firewall (WAF) web ACL. Create a rule to deny any requests that do not originate from the specified country. Attach the rule with the web ACL. Attach the web ACL with the ALB

Set up an AWS WAF web ACL. Create a rule to block the requests that do not originate from the IP range defined in an IP set containing a list of IP ranges that belong to the specified country. Attach the rule with the web ACL. Attach the web ACL with the ALB

Set up AWS Shield to block any request that does not originate from the specified country. Attach AWS Shield with the ALB

Create a Global Accelerator and attach the WAF to it. Create a rule to block any requests that do not originate from the specified country. Create the Global Accelerator to front the existing ALB

Overall explanation

Correct option:

Set up an AWS Web Application Firewall (WAF) web ACL. Create a rule to deny any requests that do not originate from the specified country. Attach the rule with the web ACL. Attach the web ACL with the ALB

AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to an Amazon CloudFront distribution, and Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync GraphQL API. AWS WAF also lets you control access to your content. Based on conditions that you specify, such as the IP addresses that requests originate from or the values of query strings, Amazon CloudFront, Amazon API Gateway, Application Load Balancer, or AWS AppSync responds to requests either with the requested content or with an HTTP 403 status code (Forbidden).

A web access control list (web ACL) gives you fine-grained control over all of the HTTP(S) web requests that your protected resource responds to. You can protect Amazon CloudFront, Amazon API Gateway, Application Load Balancer, and AWS AppSync resources. You can use criteria like the following to allow or block requests: 1. IP address origin of the request 2. Country of origin of the request 3. String match or regular expression (regex) match in a part of the request 4. Size of a particular part of the request 5. Detection of malicious SQL code or scripting

More on web request inspection and handling criteria:

via - https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html

Geographic match rule statement - To allow or block web requests based on country of origin, create one or more geographical, or geo, match statements. You can use this to block access to your site from specific countries or to only allow access from specific countries. If you want to allow some web requests and block others based on country of origin, add a geo match statement for the countries that you want to allow and add a second one for the countries that you want to block.

More on Geographic match rule:

via - https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-geo-match.html

Incorrect options:

Set up an AWS WAF web ACL. Create a rule to block the requests that do not originate from the IP range defined in an IP set containing a list of IP ranges that belong to the specified country. Attach the rule with the web ACL. Attach the web ACL with the ALB - The IP set match statement inspects the IP address of a web request against a set of IP addresses and address ranges. You can use this to allow or block web requests based on the IP addresses that the requests originate from. However, this is not an optimal solution. While defining an IP set, you need to enter one IP address or IP address range per line. Every time an IP address changes, it has to be manually added to this IP set. Hence, this option is not correct for the given use case.

Set up AWS Shield to block any request that does not originate from the specified country. Attach AWS Shield with the ALB - AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield Standard is automatically enabled when you use AWS services like Elastic Load Balancing (ELB), Application Load Balancer, Amazon CloudFront, and Amazon Route 53. You cannot use AWS Shield to block traffic from a specified country.

Create a Global Accelerator and attach the WAF to it. Create a rule to block any requests that do not originate from the specified country. Create the Global Accelerator to front the existing ALB - AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to an Amazon CloudFront distribution, and Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync GraphQL API. WAF cannot be configured with AWS Global Accelerator.

References:

https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-geo-match.html

https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html

Domain

Design for New Solutions

Question 60Correct

An e-commerce company manages its flagship applications on AWS. The Amazon EC2 instances running the applications are fronted by an Application Load Balancer (ALB). Amazon Route 53 provides public DNS services. Different URLs (mobile.ecomm.com, web.ecomm.com, api.ecomm.com) will serve the required content to the end-users.

As an AWS Certified Solutions Architect Professional, which combination of services would you use to serve the content to the end-users? (Select two)

Use Host conditions in ALB listener to route $$$$.ecomm.com to appropriate target groups

Your selection is correct

Use Host conditions in ALB listener to route ecomm.com to appropriate target groups

Your selection is correct

Use Host conditions in ALB listener to route *.ecomm.com to appropriate target groups

Use Path conditions in ALB listener to route *.ecomm.com to appropriate target groups

Use Path component of Redirect actions in ALB listener configuration to route ecomm.com to appropriate target groups

Overall explanation

Correct options:

Use Host conditions in ALB listener to route *.ecomm.com to appropriate target groups

Use Host conditions in ALB listener to route ecomm.com to appropriate target groups

You can use host conditions to define rules that route requests based on the hostname in the host header (also known as host-based routing). This enables you to support multiple subdomains and different top-level domains using a single load balancer.

A hostname is not case-sensitive, can be up to 128 characters in length, and can contain any of the following characters: 1. A–Z, a–z, 0–9 2. - . 3. * (matches 0 or more characters) 4. ? (matches exactly 1 character)

You must include at least one "." character. You can include only alphabetical characters after the final "." character.

Example hostnames: example.com, test.example.com, *.example.com

The rule *.example.com matches test.example.com but doesn't match example.com. Hence, we also need to include ecomm.com along with *.ecomm.com to include all the hosts serving the requests.

Incorrect options:

Use Path component of Redirect actions in ALB listener configuration to route ecomm.com to appropriate target groups - You can use redirect actions to redirect client requests from one URL to another. The path component has an absolute path, starting with the leading "/". A path is case-sensitive, can be up to 128 characters in length, and consists of alphanumeric characters, wildcards (* and ?), & (using &), and the following special characters: _-.$/~"'@:+. This option is not useful for the given scenario.

Use Host conditions in ALB listener to route $$$$.ecomm.com to appropriate target groups - As discussed above, - ., * or ? can be used. '$' is not a valid character.

Use Path conditions in ALB listener to route *.ecomm.com to appropriate target groups - The path component has an absolute path, starting with the leading "/". Example HTTP path patterns /img/*, /img/*/pics, etc. It does not help while dealing with hostnames, as required for the given scenario.

Reference:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

Domain

Design for New Solutions

Question 61Correct

A web development company uses FTP servers for their growing list of 200 odd clients to facilitate remote data sharing of media assets. To reduce management costs and time, the company has decided to move to AWS Cloud. The company is looking for an AWS solution that can offer increased scalability with reduced costs. Also, the company's policy mandates complete privacy and isolation of data for each client.

Which solution will you recommend for these requirements?

Your answer is correct

Create a single Amazon S3 bucket. Create an IAM user for each client. Group these users under an IAM policy that permits access to sub-folders within the bucket via the use of the 'username' Policy variable. Train the clients to use an S3 client instead of an FTP client

Create a separate S3 bucket for each client with a Bucket Policy that permits access to that client alone. Enable the Requester Pays feature so that clients pay for the cost of usage. Train the clients to use an S3 client instead of an FTP client

Create a single parent Amazon S3 bucket. Create a child bucket for each client under this parent bucket and give access through an IAM user created for each client. Train the clients to use an S3 client instead of an FTP client

Create a separate S3 bucket for each client with a Bucket Policy that permits access to that client alone. Train the clients to use an S3 client instead of an FTP client

Overall explanation

Correct option:

Create a single Amazon S3 bucket. Create an IAM user for each client. Group these users under an IAM policy that permits access to sub-folders within the bucket via the use of the 'username' Policy variable. Train the clients to use an S3 client instead of an FTP client

Instead of attaching policies to individual users, you can write a single policy that uses a policy variable and attach the policy to a group. First, you must create a group and add all the users to the group.

The attached example policy allows a set of Amazon S3 permissions in the awsexamplebucket1/${aws:username} folder. When the policy is evaluated, the policy variable ${aws:username} is replaced by the requester's user name. For example, if Alice sends a request to put an object, the operation is allowed only if Alice is uploading the object to the examplebucket/Alice folder.

Allowing each IAM user access to a folder in a bucket:

via - https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-policies-s3.html#iam-policy-ex1

Incorrect options:

Create a separate S3 bucket for each client with a Bucket Policy that permits access to that client alone. Train the clients to use an S3 client instead of an FTP client - By default, you can create up to 100 buckets in each of your AWS accounts. So, this option is not possible since the number of clients is more than 100.

Create a single parent Amazon S3 bucket. Create a child bucket for each client under this parent bucket and give access through an IAM user created for each client. Train the clients to use an S3 client instead of an FTP client - You can have folders within folders, but not buckets within buckets. Hence, this option is invalid and not a correct choice.

Create a separate S3 bucket for each client with a Bucket Policy that permits access to that client alone. Enable the Requester Pays feature so that clients pay for the cost of usage. Train the clients to use an S3 client instead of an FTP client - By default, you can create up to 100 buckets in each of your AWS accounts. So, this option is not possible since the number of clients is more than 100. The reference to Requester Pays feature has been added as a distractor.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-policies-s3.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-folders.html

Domain

Accelerate Workload Migration and Modernization

Question 62Correct

A company runs a mobile app-based health tracking solution. The mobile app sends 2 KB of data to the company’s backend servers every 2 minutes. The user data is stored in a DynamoDB table. The development team runs a nightly procedure to scan the table for extracting and aggregating the data from the previous day. These insights are then stored on Amazon S3 in JSON files for each user (daily average file size per user is approximately 1 MB). Approximately 50,000 end-users in the US are then alerted via SNS push notifications the next morning, as the new insights are available to be parsed and visualized in the mobile app.

You have been hired as an AWS Certified Solutions Architect Professional to recommend a cost-efficient solution to optimize the backend design. Which of the following options would you suggest? (Select two)

Your selection is correct

Set up a new DynamoDB table each day and drop the table for the previous day after its data is written on S3

Set up the backend to serve the insights from Amazon DynamoDB Accelerator (DAX) which can cache reads from the Amazon DynamoDB table and reduce provisioned read throughput

Your selection is correct

Set up an Amazon SQS queue to buffer writes to the Amazon DynamoDB table and reduce provisioned write throughput

Set up the backend to serve the insights directly from Amazon DynamoDB instead of JSON files stored on S3

Delete all table items for the previous day after the corresponding data is written on S3

Overall explanation

Correct options:

Set up an Amazon SQS queue to buffer writes to the Amazon DynamoDB table and reduce provisioned write throughput - DynamoDB charges you for reading, writing, and storing data in your DynamoDB tables. Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. You can use SQS to create a buffer to handle peak load and process the task asynchronously later, allowing you to reduce the provisioned write capacity on DynamoDB and thereby letting you save costs.

Set up a new DynamoDB table each day and drop the table for the previous day after its data is written on S3 - Deleting an entire table is significantly more efficient than removing items one by one, which essentially doubles the throughput requirements as you need to query/scan and then delete each item. This is the fastest and simplest method for the given use case since all the items for the previous day can be deleted from the table for that day, without the need to scan and delete each item. You can configure a process to automatically create a new table daily for handling that day's data.

Incorrect options:

Set up the backend to serve the insights directly from Amazon DynamoDB instead of JSON files stored on S3 - Given that the daily average file size per user is approximately 1 MB, you cannot use DynamoDB for storing and reading the insights data, as the maximum item size in DynamoDB is 400 KB.

Set up the backend to serve the insights from Amazon DynamoDB Accelerator (DAX) which can cache reads from the Amazon DynamoDB table and reduce provisioned read throughput - As mentioned above, you cannot use DynamoDB for storing and reading the insights data, as the maximum item size in DynamoDB is 400 KB. Therefore DAX also cannot be used since it's just a caching layer for DynamoDB.

Delete all table items for the previous day after the corresponding data is written on S3 - For the given use case, deleting the entire table is significantly more efficient than deleting items one-by-one for the previous day, which essentially doubles the throughput requirements as you need to query/scan and then delete each item.

References:

https://medium.com/analytics-vidhya/how-to-delete-huge-data-from-dynamodb-table-f3be586c011c

https://stackoverflow.com/questions/9154264/what-is-the-recommended-way-to-delete-a-large-number-of-items-from-dynamodb

https://docs.aws.amazon.com/cli/latest/reference/dynamodb/delete-table.html

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithItems.html

Domain

Accelerate Workload Migration and Modernization

Question 63Correct

A social gaming company is developing a mobile game that streams score updates to a backend processor and then publishes results on a leaderboard. The company has hired you to design a solution that can handle major traffic spikes, process the mobile game updates in the order of receipt, and store the processed updates in a highly available database. The company wants to minimize the management overhead required to maintain the solution.

Which of the following solutions will you recommend to meet these requirements?

Send score updates to Kinesis Data Streams which uses a fleet of EC2 instances (with Auto Scaling) to process the updates in Kinesis Data Streams and then store these processed updates in DynamoDB

Your answer is correct

Send score updates to Kinesis Data Streams which uses a Lambda function to process these updates and then store these processed updates in DynamoDB

Send score updates to an SNS topic, subscribe a Lambda function to this SNS topic to process the updates and then store these processed updates in a SQL database running on Amazon EC2

Send score updates to an SQS queue which uses a fleet of EC2 instances (with Auto Scaling) to process these updates in the SQS queue and then store these processed updates in an RDS MySQL database

Overall explanation

Correct option:

Send score updates to Kinesis Data Streams which uses a Lambda function to process these updates and then store these processed updates in DynamoDB

To help ingest real-time data or streaming data at large scale, you can use Amazon Kinesis Data Streams (KDS). KDS can continuously capture gigabytes of data per second from hundreds of thousands of sources. The data collected is available in milliseconds, enabling real-time analytics. KDS provides ordering of records, as well as the ability to read and/or replay records in the same order to multiple Amazon Kinesis Applications.

Lambda integrates natively with Kinesis Data Streams. The polling, checkpointing, and error handling complexities are abstracted when you use this native integration. The processed data can then be configured to be saved in DynamoDB.

Incorrect options:

Send score updates to an SQS queue which uses a fleet of EC2 instances (with Auto Scaling) to process these updates in the SQS queue and then store these processed updates in an RDS MySQL database

Send score updates to Kinesis Data Streams which uses a fleet of EC2 instances (with Auto Scaling) to process the updates in Kinesis Data Streams and then store these processed updates in DynamoDB

Send score updates to an SNS topic, subscribe a Lambda function to this SNS topic to process the updates, and then store these processed updates in a SQL database running on Amazon EC2

These three options use EC2 instances as part of the solution architecture. The use-case seeks to minimize the management overhead required to maintain the solution. However, EC2 instances involve several maintenance activities such as managing the guest operating system and software deployed to the guest operating system, including updates and security patches, etc. Hence these options are incorrect.

Reference:

https://aws.amazon.com/blogs/big-data/best-practices-for-consuming-amazon-kinesis-data-streams-using-aws-lambda/

Domain

Design for New Solutions

Question 64Correct

A supply-chain manufacturing company manages its AWS resources in an Elastic Beanstalk environment. For implementing a new security requirement, the company needs to assign a single static IP address to a load-balanced Elastic Beanstalk environment. Subsequently, this IP address will be used to uniquely identify traffic coming from the Elastic Beanstalk environment.

As a solutions architect, which of the following would you recommend as the BEST solution that requires minimal maintenance?

Attach the same Elastic IP to all instances to obtain a single publicly exposed IP address

Use a Bastion host to map multiple IP addresses into a single publicly exposed IP address

Your answer is correct

Use a Network Address Translation (NAT) gateway to map multiple IP addresses into a single publicly exposed IP address

Use a Network Address Translation (NAT) instance to map multiple IP addresses into a single publicly exposed IP address

Overall explanation

Correct option:

Use a Network Address Translation (NAT) gateway to map multiple IP addresses into a single publicly exposed IP address

Use a network address translation (NAT) gateway to map multiple IP addresses into a single publicly exposed IP address. When your Elastic Beanstalk environment uses a NAT gateway, the backend instances in your environment are launched in private subnets. Elastic Beanstalk routes outbound traffic through the NAT gateway. You can identify the source of the outbound traffic from the backend instances by the Elastic IP address. The Elastic IP address is a static IP address required by the NAT gateway.

The following steps are needed to implement this change. Elastic Beanstalk launches your Amazon Elastic Compute Cloud (Amazon EC2) instances into private subnets. These private subnets use a NAT gateway with an attached Elastic IP address as a default route. The load balancer is in public subnets. Elastic Beanstalk routes all external traffic to and from the load balancer through an internet gateway.

Incorrect options:

Attach the same Elastic IP to all instances to obtain a single publicly exposed IP address - This statement is incorrect. If an instance is in a private subnet then it not possible to attach an Elastic IP to it. Also, Elastic IP can only be used with one instance at a time.

Use a Network Address Translation (NAT) instance to map multiple IP addresses into a single publicly exposed IP address - You can use an Elastic IP address or a public IP address with a NAT instance. But, NAT instances have to be managed by the customers which do not meet the requirement of minimal maintenance, as mandated for the given use case.

Use a Bastion host to map multiple IP addresses into a single publicly exposed IP address - A bastion host is a server used to provide access to a private network from an external network, such as the Internet. The bastion host is not relevant for the given use case.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/elastic-beanstalk-static-IP-address/

https://medium.com/awesome-cloud/aws-vpc-difference-between-internet-gateway-and-nat-gateway-c9177e710af6

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-comparison.html

Domain

Continuous Improvement for Existing Solutions

Question 65Correct

A healthcare company is migrating sensitive data from its on-premises data center to AWS Cloud via an existing AWS Direct Connect connection. The company must ensure confidentiality and integrity of the data in transit to the AWS VPC.

Which of the following options should be combined to set up the most cost-effective connection between your on-premises data center and AWS? (Select three)

Create a VPC with an internet gateway

Create an IPsec tunnel between your customer gateway and a software VPN on Amazon EC2 in the VPC

Your selection is correct

Create a VPC with a virtual private gateway

Your selection is correct

Create an IPsec tunnel between your customer gateway appliance and the virtual private gateway

Set up a private virtual interface on the Direct Connect connection

Your selection is correct

Set up a public virtual interface on the Direct Connect connection

Overall explanation

Correct options:

Create a VPC with a virtual private gateway

Set up a public virtual interface on the Direct Connect connection

Create an IPsec tunnel between your customer gateway appliance and the virtual private gateway

AWS Direct Connect is a networking service that provides an alternative to using the internet to connect to AWS. Using Direct Connect, data that would have previously been transported over the internet is delivered through a private network connection between your facilities and AWS

AWS Direct Connect (DX) provides three types of virtual interfaces - public, private, and transit.

Private virtual interface: A private virtual interface should be used to access an Amazon VPC using private IP addresses.

Public virtual interface: A public virtual interface can access all AWS public services using public IP addresses.

Transit virtual interface: A transit virtual interface should be used to access one or more Amazon VPC Transit Gateways associated with Direct Connect gateways. You can use transit virtual interfaces with 1/2/5/10 Gbps AWS Direct Connect connections.

Direct Connect Virtual Interfaces:

via - https://aws.amazon.com/premiumsupport/knowledge-center/public-private-interface-dx/

By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection.

via - https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

You can combine AWS Direct Connect dedicated network connections with the Amazon VPC VPN. AWS Direct Connect public VIF can be used to establish a dedicated network connection between your network to public AWS resources, such as an Amazon virtual private gateway IPsec endpoint. This solution combines the benefits of the end-to-end secure IPSec connection with low latency and increased bandwidth of the AWS Direct Connect to provide a more consistent network experience than internet-based VPN connections.

via https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-vpn.html

Incorrect options:

Create an IPsec tunnel between your customer gateway and a software VPN on Amazon EC2 in the VPC - For the given use case, you can only create an IPSec tunnel for AWS Site-to-Site VPN on the Direct Connect connection between your customer gateway appliance and the virtual private gateway. You cannot use the software VPN on Amazon EC2 to meet the given requirements.

Set up a private virtual interface on the Direct Connect connection - Only AWS Direct Connect public VIF can be used to establish a dedicated network connection between your network to public AWS resources, such as an Amazon virtual private gateway IPsec endpoint.

Create a VPC with an internet gateway - You need to create a VPC with a virtual private gateway to support a Site-to-Site VPN over the Direct Connect connection.

References:

https://docs.aws.amazon.com/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.html

https://aws.amazon.com/premiumsupport/knowledge-center/public-private-interface-dx/

https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-vpn.html

Domain

Accelerate Workload Migration and Modernization

Question 66Correct

A company has three VPCs: A, B, and C. VPCs A and C are both peered with VPC B. The IP address ranges are as follows:

VPC A: 10.1.0.0/16

VPC B: 192.168.0.0/16

VPC C: 10.1.0.0/16

Instance a-1 in VPC A has the IP address 10.1.0.10. Instance c-1 in VPC C has the IP address 10.1.0.10. Instances b-1 and b-2 in VPC B have the IP addresses 192.168.2.10 and 192.168.2.20 respectively. The instances b-1 and b-2 are in the subnet 192.168.2.0/24.

The networking team at the company has mandated that b-1 must be able to communicate with a-1, and b-2 must be able to communicate with c-1. However, the team has noticed that both b-1 and b-2 are only able to communicate with a-1; instead of b-1 communicating with a-1 and b-2 communicating with c-1.

Which of the following combination of steps will address this issue? (Select two)

Your selection is correct

Discard existing subnet in VPC B. Create two new subnets 192.168.2.0/28 and 192.168.2.16/28 in VPC B. Move b-1 to subnet 192.168.2.0/28 and b-2 to subnet 192.168.2.16/28 by launching a new instance in the new subnet via an AMI created from the old instance

Discard existing subnet in VPC B. Create two new subnets 192.168.2.0/29 and 192.168.2.16/29 in VPC B. Move b-1 to subnet 192.168.2.0/29 and b-2 to subnet 192.168.2.16/29 by launching a new instance in the new subnet via an AMI created from the old instance

Discard existing subnet in VPC B. Create two new subnets 192.168.2.0/27 and 192.168.2.16/27 in VPC B. Move b-1 to subnet 192.168.2.0/27 and b-2 to subnet 192.168.2.16/27 by launching a new instance in the new subnet via an AMI created from the old instance

Create one route table in VPC B - with distinct route entries for destination VPC A and VPC C

Your selection is correct

Create two route tables in VPC B - one with a route for destination VPC A and another with a route for destination VPC C

Overall explanation

Correct options:

Discard existing subnet in VPC B. Create two new subnets 192.168.2.0/28 and 192.168.2.16/28 in VPC B. Move b-1 to subnet 192.168.2.0/28 and b-2 to subnet 192.168.2.16/28 by launching a new instance in the new subnet via an AMI created from the old instance

Create two route tables in VPC B - one with a route for destination VPC A and another with a route for destination VPC C

A virtual private cloud (VPC) is a virtual network dedicated to your AWS account. It is logically isolated from other virtual networks in the AWS Cloud. You can launch your AWS resources, such as Amazon EC2 instances, into your VPC. After you create a VPC, you can add one or more subnets in each Availability Zone. A subnet is a range of IP addresses in your VPC. You can launch AWS resources, such as EC2 instances, into a specific subnet. When you create a subnet, you specify the IPv4 CIDR block for the subnet, which is a subset of the VPC CIDR block.

For the given use case, you can create two new subnets 192.168.2.0/28 and 192.168.2.16/28 which will ensure a distinct IP address range for both subnets. You can then migrate the respective instances by creating a new Amazon Machine Image (AMI) from the source instance. An Amazon Machine Image (AMI) provides the information required to launch an instance. Further, you need to create two route tables in VPC B. Associate the first route table having a route for destination VPC A with the subnet 192.168.2.0/28. Associate the second route table having route for destination VPC C with the subnet 192.168.2.16/28. Although both destination VPCs X and Z have the same IP address range 10.1.0.0/16 however the solution would work as the routes are in separate route tables.

Incorrect options:

Discard existing subnet in VPC B. Create two new subnets 192.168.2.0/29 and 192.168.2.16/29 in VPC B. Move b-1 to subnet 192.168.2.0/29 and b-2 to subnet 192.168.2.16/29 by launching a new instance in the new subnet via an AMI created from the old instance - You cannot have subnet CIDR with a /29 range since AWS allows CIDR range only between /28 and /16.

Discard existing subnet in VPC B. Create two new subnets 192.168.2.0/27 and 192.168.2.16/27 in VPC B. Move b-1 to subnet 192.168.2.0/27 and b-2 to subnet 192.168.2.16/27 by launching a new instance in the new subnet via an AMI created from the old instance - You cannot have /27 range as it would result in the same IP range - 192.168.2.1 through 192.168.2.31 - to be allocated for both subnets. So this option is incorrect.

Create one route table in VPC B - with distinct route entries for destination VPC A and VPC C - You cannot have distinct routes for destination VPC A and VPC C in the same route table as both the destination VPCs have the same IP address range 10.1.0.0/16.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html

Domain

Design Solutions for Organizational Complexity

Question 67Incorrect

A pharmaceutical company uses AWS Cloud to run multiple workloads with each workload managed by its software development team. The company leverages AWS Organizations and SAML-based federation to provide access to its development teams. A single shared production AWS account is used by all teams to deploy their production workloads. Recently, the company faced an incident when one of the teams had accidentally shut down a production EC2 instance used by another team.

As an AWS Certified Solutions Architect Professional, you have been tasked to devise a solution that will eliminate the possibility of recurrence of such an event while making sure that all the teams still retain the necessary access permissions to their AWS resources in the shared AWS account. Which solution is the best fit for these requirements?

Your answer is incorrect

During SAML-based federation, pass an attribute for DevelopmentDept as an AWS Security Token Service (AWS STS) session tag. Set up an SCP with an allow action and a StringEquals condition for the DevelopmentDept resource tag and aws:PrincipalTag/DevelopmentDept. Assign the SCP to the root OU

Set up separate OUs for each development department in AWS Organizations. Assign the created OUs to the company AWS accounts. Set up separate SCPs with a deny action and a StringNotEquals condition for the DevelopmentDept resource tag that matches the development department name. Assign the SCP to the corresponding OU

Set up separate IAM policies for each development department. Add an allow action and a StringEquals condition for the DevelopmentDept resource tag and the development dept name in each of these policies. During SAML federation, use AWS Security Token Service (AWS STS) to assign the IAM policy and match the development dept name to the IAM role assumed by the developers

Correct answer

During SAML-based federation, pass an attribute for DevelopmentDept as an AWS Security Token Service (AWS STS) session tag. The policy of the assumed IAM role used by the developers should be updated with a deny action and a StringNotEquals condition for the DevelopmentDept resource tag and aws:PrincipalTag/ DevelopmentDept

Overall explanation

Correct option:

During SAML-based federation, pass an attribute for DevelopmentDept as an AWS Security Token Service (AWS STS) session tag. The policy of the assumed IAM role used by the developers should be updated with a deny action and a StringNotEquals condition for the DevelopmentDept resource tag and aws:PrincipalTag/ DevelopmentDept

You can pass session tags when you assume a role or federate a user. You can then define policies that use tag condition keys to grant permissions to your principals based on their tags. When you use tags to control access to your AWS resources, you allow your teams and resources to grow with fewer changes to AWS policies.

If your company uses a SAML-based identity provider (IdP) to manage corporate user identities, you can use SAML attributes for fine-grained access control in AWS. Attributes can include cost center identifiers, user email addresses, department classifications, and project assignments. When you pass these attributes as session tags, you can then control access to AWS based on these session tags.

An example policy with SAML session tags:

via - https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_abac-saml.html

Incorrect options:

Set up separate IAM policies for each development department. Add an allow action and a StringEquals condition for the DevelopmentDept resource tag and the development dept name in each of these policies. During SAML federation, use AWS Security Token Service (AWS STS) to assign the IAM policy and match the development dept name to the IAM role assumed by the developers - IAM Policies cannot be attached to an IAM role by using AWS STS, so this option is incorrect.

Set up separate OUs for each development department in AWS Organizations. Assign the created OUs to the company AWS accounts. Set up separate SCPs with a deny action and a StringNotEquals condition for the DevelopmentDept resource tag that matches the development department name. Assign the SCP to the corresponding OU - An OU can have exactly one parent, and currently, each account can be a member of exactly one OU. A single shared production account is being utilized by all teams which can only be part of one OU, so this choice is irrelevant to the given use case.

During SAML-based federation, pass an attribute for DevelopmentDept as an AWS Security Token Service (AWS STS) session tag. Set up an SCP with an allow action and a StringEquals condition for the DevelopmentDept resource tag and aws:PrincipalTag/DevelopmentDept. Assign the SCP to the root OU - This solution does not restrict user access permissions in any way and hence is not useful for the given use case.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_abac-saml.html

https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html

Domain

Design Solutions for Organizational Complexity

Question 68Correct

A firm has created different AWS Virtual Private Cloud (VPCs) for each project belonging to a client. For inter-project functionality, the firm needs to connect to a load balancer in VPC V1 from the Amazon EC2 instance in VPC V2.

How will you set up the access to the internal load balancer for this use case in the most cost-effective manner?

Establish connectivity between VPC V1 and VPC V2 using Transit Gateway. Update route tables inside the transit gateway, and change the VPC association to these route tables. Establish the necessary security group rules, and network access control list (ACL) rules to allow traffic between the VPCs

Establish connectivity between VPC V1 and VPC V2 using VPC Interface endpoint. Enable DNS delegation from the source VPC for VPC peering. Establish the necessary routes, security group rules, and network access control list (ACL) rules to allow traffic between the VPCs

Establish connectivity between VPC V1 and VPC V2 using VPC Gateway endpoint. Enable DNS resolution from the source VPC for VPC peering. Establish the necessary routes, security group rules, and network access control list (ACL) rules to allow traffic between the VPCs

Your answer is correct

Establish connectivity between VPC V1 and VPC V2 using VPC peering. Enable DNS resolution from the source VPC for VPC peering. Establish the necessary routes, security group rules, and network access control list (ACL) rules to allow traffic between the VPCs

Overall explanation

Correct option:

Establish connectivity between VPC V1 and VPC V2 using VPC peering. Enable DNS resolution from the source VPC for VPC peering. Establish the necessary routes, security group rules, and network access control list (ACL) rules to allow traffic between the VPCs

To access an internal load balancer in VPC A from VPC B:

Establish connectivity between VPC A and VPC B using VPC peering.

Enable DNS resolution from the source VPC for VPC peering.

Establish the necessary routes, security group rules, and network access control list (ACL) rules to allow traffic between the VPCs.

Using VPC peering, you can access internal load balancers (including Classic Load Balancers, Application Load Balancers, and Network Load Balancers) from another VPC.

Complete Steps for configuring VPC peering:

via - https://aws.amazon.com/premiumsupport/knowledge-center/elb-access-load-balancer-vpc-peering/

Incorrect options:

Establish connectivity between VPC V1 and VPC V2 using VPC Gateway endpoint. Enable DNS resolution from the source VPC for VPC peering. Establish the necessary routes, security group rules, and network access control list (ACL) rules to allow traffic between the VPCs - A VPC endpoint enables connections between a virtual private cloud (VPC) and the supported services, without requiring that you use an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. A Gateway endpoint is a gateway that is a target for a route in your route table used for traffic destined to either Amazon S3 or DynamoDB. Using the VPC Gateway endpoint, you cannot access the internal load balancer in another VPC.

Establish connectivity between VPC V1 and VPC V2 using VPC Interface endpoint. Enable DNS delegation from the source VPC for VPC peering. Establish the necessary routes, security group rules, and network access control list (ACL) rules to allow traffic between the VPCs - A VPC endpoint enables connections between a virtual private cloud (VPC) and the supported services, without requiring that you use an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. An Interface endpoint is an elastic network interface with a private IP address from the IP address range of your subnet. It serves as an entry point for traffic destined to a service that is owned by AWS or owned by an AWS customer or partner. Using VPC Interface endpoint, you cannot access the internal load balancer in another VPC.

Establish connectivity between VPC V1 and VPC V2 using Transit Gateway. Update route tables inside the transit gateway, and change the VPC association to these route tables. Establish the necessary security group rules, and network access control list (ACL) rules to allow traffic between the VPCs - A Transit Gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways using the AWS Global Infrastructure. Although you can connect VPCs using Transit Gateway, it is much more expensive than using VPC peering, so this option is incorrect for the given use case.

References:

https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html

https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html

Domain

Accelerate Workload Migration and Modernization

Question 69Correct

An e-commerce company has a three-tier web application with separate subnets for Web, Application and Database tiers. The CTO at the company wants to monitor any malicious activity targeting the web application running on EC2 instances. As a solutions architect, you have been tasked with developing a solution to notify the security team in case the network exposure of EC2 instances on specific ports violates the security policies of the company.

Which AWS Services would you use to build an automated notification system to meet these requirements with the least development effort? (Select two)

AWS Shield

Your selection is correct

Amazon Inspector

Your selection is correct

Amazon SNS

VPC Flow Logs

Amazon CloudWatch

Overall explanation

Correct options:

Amazon SNS

Amazon Inspector

Amazon Inspector is an automated security assessment service that helps you test the network accessibility of your Amazon EC2 instances and the security state of your applications running on the instances.

You can perform network security assessments via your own custom solutions, however, that entails significant time and effort. You might need to run network port-scanning tools to test routing and firewall configurations, then validate what processes are listening on your instance network ports, before finally mapping the IPs identified in the port scan back to the host’s owner.

To make this process simpler for its customers, AWS offers the Network Reachability rules package in Amazon Inspector, which is an automated security assessment service that enables you to understand and improve the security and compliance of applications deployed on AWS. The existing Amazon Inspector host assessment rules packages check the software and configurations on your Amazon Elastic Compute Cloud (Amazon EC2) instances for vulnerabilities and deviations from best practices.

via https://aws.amazon.com/blogs/security/amazon-inspector-assess-network-exposure-ec2-instances-aws-network-reachability-assessments/

You can use these rules packages to analyze the accessibility of critical ports, as well as all other network ports. For critical ports, Amazon Inspector will show the exposure of each and will offer findings per port. When critical, well-known ports (based on Amazon’s standard guidance) are reachable, findings will be created with higher severities.

via https://aws.amazon.com/blogs/security/amazon-inspector-assess-network-exposure-ec2-instances-aws-network-reachability-assessments/

The findings also have recommendations that include information about exactly which Security Group you can edit to remove the access. And like all Amazon Inspector findings, these can be published to an SNS topic for additional processing or you could use a Lambda to automatically remove ingress rules in the Security Group to address a network reachability finding. For the given use case, the network engineer can use the SNS topic to send the notifications to the team.

Incorrect options:

AWS Shield - AWS Shield is a managed service that protects against Distributed Denial of Service (DDoS) attacks for applications running on AWS. AWS Shield Standard is automatically enabled to all AWS customers at no additional cost. AWS Shield Advanced is an optional paid service. AWS Shield Advanced provides additional protections against more sophisticated and larger attacks for your applications running on Amazon EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53. AWS Shield cannot be used to assess network exposure of EC2 instances on specific ports.

Amazon CloudWatch - Amazon CloudWatch is a monitoring service for AWS cloud resources and the applications you run on AWS. You can use Amazon CloudWatch to collect and track metrics, collect and monitor log files, and set alarms. CloudWatch cannot be used to assess network exposure of EC2 instances on specific ports.

VPC Flow Logs - VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs or Amazon S3. You can create a flow log for a VPC, a subnet, or a network interface. If you create a flow log for a subnet or VPC, each network interface in that subnet or VPC is monitored. You can use VPC Flow Logs to assess network exposure of EC2 instances on specific ports but the solution would entail significant development effort to parse through the logs and identify the exposed ports. So this option is incorrect.

Reference:

https://aws.amazon.com/blogs/security/amazon-inspector-assess-network-exposure-ec2-instances-aws-network-reachability-assessments/

Domain

Design for New Solutions

Question 70Correct

A global multi-player gaming application runs on UDP protocol and it needs to add functionality where you can assign multiple players to a single session on a game server based on factors such as geographic location, player skill, and a few more configurable parameters. The application is accessed by players spread out across different regions of the world.

What is the BEST way to configure this requirement?

Use Application Load Balancer (ALB) with sticky sessions enabled to maintain player session data. Configure Global Accelerator to front the ALB for cross-region elasticity

Your answer is correct

Use custom routing accelerator of Global Accelerator to deterministically route one or more users to a specific instance using VPC subnet endpoints

Use custom routing accelerator of Global Accelerator in front of Network Load Balancer (NLB) to route traffic that can maintain session data

Use custom routing accelerator of Global Accelerator to deterministically route one or more users to a specific instance using VPC sharing

Overall explanation

Correct option:

Use custom routing accelerator of Global Accelerator to deterministically route one or more users to a specific instance - A custom routing accelerator is a new type of accelerator in Global Accelerator. It allows you to use your own application logic to deterministically route one or more users to a specific Amazon EC2 instance destination in a single or multiple AWS Regions. This is useful for use cases where you want to control which session on an EC2 instance your user traffic is sent to.

One example is a multi-player gaming application where you want to assign multiple players to a single session on a game server, based on factors such as geographic location, player skill, and gaming configuration. Other examples are VoIP, EdTech, and social media applications that assign multiple users to a specific media server to initiate voice, video, and messaging sessions. With a custom routing accelerator, you can direct multiple users to a unique port on your accelerator, and their traffic will be routed to a specific destination IP address and port that your application session is running on.

Custom routing accelerators support only VPC subnet endpoints, each containing one or more EC2 instances that are running your application. Each VPC subnet endpoint, which could be in a single or multiple Regions, contains the IP addresses of the EC2 instances that host your application. With a custom routing accelerator, you can put your accelerator in front of up to thousands of EC2 instances running in a single or multiple VPCs. Custom routing accelerators support VPC subnet endpoints with a maximum size of /17 and route traffic only to EC2 instances within each subnet.

Incorrect options:

Use Application Load Balancer (ALB) with sticky sessions enabled to maintain player session data. Configure Global Accelerator to front the ALB for cross-region elasticity - Application Load Balancer (ALB) cannot be used for UDP traffic. It works for HTTP and HTTPS traffic only.

Use custom routing accelerator of Global Accelerator to deterministically route one or more users to a specific instance using VPC sharing - VPC sharing allows multiple AWS accounts to create their application resources, such as Amazon EC2 instances, Amazon Relational Database Service (RDS) databases, Amazon Redshift clusters, and AWS Lambda functions, into shared, centrally-managed virtual private clouds (VPCs). Custom routing accelerator supports only VPC subnet endpoints.

Use custom routing accelerator of Global Accelerator in front of Network Load Balancer (NLB) to route traffic that can maintain session data - As discussed above, Custom routing accelerator supports only VPC subnet endpoints.

Reference:

https://aws.amazon.com/global-accelerator/features/

Domain

Design for New Solutions

Question 71Correct

A media company uses Amazon S3 under the hood to power its offerings which allow the customers to upload and view the media files immediately. Currently, all the customer files are uploaded directly under a single S3 bucket. The systems administration team has started seeing scalability issues where customer file uploads are failing during the peak access hours with more than 5000 requests per second.

Which of the following represents the MOST resource-efficient and cost-optimal way of resolving this issue?

Your answer is correct

Change the application architecture to create customer-specific custom prefixes within the single bucket and then upload the daily files into those prefixed locations

Change the application architecture to create a new S3 bucket for each customer and then upload each customer's files directly under the respective buckets

Change the application architecture to use S3 Glacier Deep Archive storage class

Change the application architecture to create a new S3 bucket for each day's data and then upload the daily files directly under that day's bucket

Overall explanation

Correct option:

Change the application architecture to create customer-specific custom prefixes within the single bucket and then upload the daily files into those prefixed locations

Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. Your applications can easily achieve thousands of transactions per second in request performance when uploading and retrieving storage from Amazon S3. Amazon S3 automatically scales to high request rates. For example, your application can achieve at least 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix in a bucket.

There are no limits to the number of prefixes in a bucket. You can increase your read or write performance by parallelizing reads. For example, if you create 10 prefixes in an Amazon S3 bucket to parallelize reads, you could scale your read performance to 55,000 read requests per second. Please see this example for more clarity on prefixes: if you have a file f1 stored in an S3 object path like so s3://your_bucket_name/folder1/sub_folder_1/f1, then /folder1/sub_folder_1/ becomes the prefix for file f1.

Some data lake applications on Amazon S3 scan millions or billions of objects for queries that run over petabytes of data. These data lake applications achieve single-instance transfer rates that maximize the network interface used for their Amazon EC2 instance, which can be up to 100 Gb/s on a single instance. These applications then aggregate throughput across multiple instances to get multiple terabits per second. Therefore creating customer-specific custom prefixes within the single bucket and then uploading the daily files into those prefixed locations is the BEST solution for the given constraints.

Optimizing Amazon S3 Performance:

via - https://docs.aws.amazon.com/AmazonS3/latest/dev/optimizing-performance.html

Incorrect options:

Change the application architecture to create a new S3 bucket for each customer and then upload each customer's files directly under the respective buckets - Creating a new S3 bucket for each new customer is an inefficient way of handling resource availability (S3 buckets need to be globally unique) as some customers may use the service sparingly but the bucket name is locked for them forever. Moreover, this is not required as we can use S3 prefixes to improve the performance.

Change the application architecture to create a new S3 bucket for each day's data and then upload the daily files directly under that day's bucket - Creating a new S3 bucket for each new day's data is also an inefficient way of handling resource availability (S3 buckets need to be globally unique) as some of the bucket names may not be available for daily data processing. Moreover, this is not required as we can use S3 prefixes to improve the performance.

Change the application architecture to use S3 Glacier Deep Archive storage class - Glacier Deep Archive is designed to provide durable and secure long-term storage for large amounts of data at a price that is competitive with off-premises tape archival services. Data is stored across 3 or more AWS Availability Zones and can be retrieved in 12 hours or less. This option is a distractor because Glacier Deep Archive would not allow customers to retrieve the objects immediately.

Reference:

https://docs.aws.amazon.com/AmazonS3/latest/dev/optimizing-performance.html

Domain

Accelerate Workload Migration and Modernization

Question 72Correct

A company uses Amazon S3 storage service for storing its business data. Multiple S3 event notifications have been configured to be delivered to Amazon Simple Queue Service (Amazon SQS) queue when objects pass through the storage lifecycle. The team has noticed that notifications are not being delivered to the queue. Amazon SQS queue has server-side encryption (SSE) turned on.

What should be done to receive the S3 event notifications to an Amazon SQS queue that uses SSE?

Create an AWS-managed KMS key and configure the key policy to grant permissions to the Amazon S3 service principal

Create a KMS custom key store using Hardware Security Module (HSM) and configure the key policy to grant permissions to the Amazon S3 service principal

Your answer is correct

Create a customer-managed AWS KMS key and configure the key policy to grant permissions to the Amazon S3 service principal

Create an AWS-owned KMS key and configure the key policy to grant permissions to the Amazon S3 service principal

Overall explanation

Correct option:

Server-side encryption is the encryption of data at its destination by the application or service that receives it. Server-side encryption (SSE) lets you transmit sensitive data in encrypted queues. SSE protects the contents of messages in queues using SQS-managed encryption keys (SSE-SQS) or keys managed in the AWS Key Management Service (SSE-KMS).

The KMS keys that you create are customer-managed keys. Customer-managed keys are KMS keys in your AWS account that you create, own, and manage. You have full control over these KMS keys, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, rotating their cryptographic material, adding tags, creating aliases that refer to the KMS keys, and scheduling the KMS keys for deletion. In addition, many AWS services that integrate with AWS KMS let you specify a customer-managed key to protect the data stored and managed for you.

The default AWS-managed KMS key can't be modified. Hence, a customer-managed AWS KMS key needs to be used.

You can encrypt Amazon SQS queues with a customer-managed AWS Key Management Service (AWS KMS) key. However, you must grant the Amazon S3 service principal permissions to work with encrypted topics or queues. To grant the Amazon S3 service principal permissions, you replace the principal with your root account Amazon Resource Name (ARN) in the customer-managed key policy.

Configuring SQS queue KMS permissions for AWS services:

via - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-key-management.html#compatibility-with-aws-services

Incorrect options:

Create an AWS-managed KMS key and configure the key policy to grant permissions to the Amazon S3 service principal - AWS-managed keys are KMS keys in your account that are created, managed, and used on your behalf by an AWS service integrated with AWS KMS. The default AWS-managed KMS key can't be modified, hence this statement is incorrect.

Create an AWS-owned KMS key and configure the key policy to grant permissions to the Amazon S3 service principal - AWS-owned keys are a collection of KMS keys that an AWS service owns and manages for use in multiple AWS accounts. Although AWS-owned keys are not in your AWS account, an AWS service can use an AWS-owned key to protect the resources in your account. You cannot create an AWS-owned KMS Key, hence this statement is incorrect.

Create a KMS custom key store using Hardware Security Module (HSM) and configure the key policy to grant permissions to the Amazon S3 service principal - This option has been added as a distractor. A custom key store is not the same thing as a key.

References:

https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk

https://aws.amazon.com/premiumsupport/knowledge-center/sqs-s3-event-notification-sse/

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html

Domain

Continuous Improvement for Existing Solutions

Question 73Incorrect

For deployments across AWS accounts, a company has decided to use AWS CodePipeline to deploy an AWS CloudFormation stack in an AWS account (account A) to a different AWS account (account B).

As a solutions architect, what combination of steps will you take to configure this requirement? (Select three)

Correct selection

In account B, create a service role for the CloudFormation stack that includes the required permissions for the services deployed by the stack. In account A, update the CodePipeline configuration to include the resources associated with account B

Your selection is incorrect

In account B, add the AssumeRole permission to account A's CodePipeline service role to allow it to assume the cross-account role in account A

Correct selection

In account B, create a cross-account IAM role. In account A, add the AssumeRole permission to account A's CodePipeline service role to allow it to assume the cross-account role in account B

In Account A, create a customer-managed AWS KMS key that grants usage permissions to account A's CodePipeline service role and account B. In Account B, create an Amazon Simple Storage Service (Amazon S3) bucket with a bucket policy that grants account A access to the bucket

Your selection is incorrect

In account A, create a service role for the CloudFormation stack that includes the required permissions for the services deployed by the stack. In account B, update the CodePipeline configuration to include the resources associated with account A

Your selection is correct

In account A, create a customer-managed AWS KMS key that grants usage permissions to account A's CodePipeline service role and account B. Also, create an Amazon Simple Storage Service (Amazon S3) bucket with a bucket policy that grants account B access to the bucket

Overall explanation

Correct options:

In account A, create a customer-managed AWS KMS key that grants usage permissions to account A's CodePipeline service role and account B. Also, create an Amazon Simple Storage Service (Amazon S3) bucket with a bucket policy that grants account B access to the bucket

In account B, create a cross-account IAM role. In account A, add the AssumeRole permission to account A's CodePipeline service role to allow it to assume the cross-account role in account B

In account B, create a service role for the CloudFormation stack that includes the required permissions for the services deployed by the stack. In account A, update the CodePipeline configuration to include the resources associated with account B

Complete list of steps for configuring the requirement:

via - https://aws.amazon.com/premiumsupport/knowledge-center/codepipeline-deploy-cloudformation/

Incorrect options:

In Account A, create a customer-managed AWS KMS key that grants usage permissions to account A's CodePipeline service role and account B. In Account B, create an Amazon Simple Storage Service (Amazon S3) bucket with a bucket policy that grants account A access to the bucket

In account A, create a service role for the CloudFormation stack that includes the required permissions for the services deployed by the stack. In account B, update the CodePipeline configuration to include the resources associated with account A

In account B, add the AssumeRole permission to account A's CodePipeline service role to allow it to assume the cross-account role in account A

Reference:

https://aws.amazon.com/premiumsupport/knowledge-center/codepipeline-deploy-cloudformation/

Domain

Continuous Improvement for Existing Solutions

Question 74Correct

A business has hosted their custom made log data analyzer application on AWS. The application examines the generated log data using the date ranges. Every day the application generates around 15 GB of data which is expected to keep growing in the future. As a solutions architect, you are responsible for storing the data in Amazon S3 and analyzing it using Amazon Athena.

What combination of steps will you recommend for the best-performing solution? (Select two)

Leverage bucketed tables within Athena by using Apache Spark bucketing format

Your selection is correct

Partition the data in Amazon S3 using Apache Hive partitioning. Use a date column as partition key

Your selection is correct

Store the data in Amazon S3 in a columnar format such as Apache Parquet

Store the data in Amazon S3 in an uncompressed format

Store the data in Amazon S3 in objects that are smaller than 10 MB

Overall explanation

Correct options:

Store the data in Amazon S3 in columnar formats, such as Apache Parquet or Apache ORC - Apache Parquet and Apache ORC are popular columnar data stores. They provide features that store data efficiently by employing column-wise compression, different encoding, compression based on data type, and predicate pushdown. They are also splittable. Generally, better compression ratios or skipping blocks of data means reading fewer bytes from Amazon S3, leading to better query performance. You can convert your existing data to Parquet or ORC using Spark or Hive on Amazon EMR.

Partition the data in Amazon S3 using Apache Hive partitioning. Use a date column as partition key - By partitioning your data, you can restrict the amount of data scanned by each query, thus improving performance and reducing cost. You can partition your data by any key. A common practice is to partition the data based on time, often leading to a multi-level partitioning scheme. For example, a customer who has data coming in every hour might decide to partition by year, month, date, and hour. Another customer, who has data coming from many different sources but that is loaded only once per day, might partition by a data source identifier and date.

An example of data stored on Amazon S3 in Hive format:

via - https://docs.aws.amazon.com/athena/latest/ug/partitions.html

Incorrect options:

Store the data in Amazon S3 in objects that are smaller than 10 MB - Queries run more efficiently when reading data can be parallelized and when blocks of data can be read sequentially. Ensuring that your file formats are splittable helps with parallelism regardless of how large your files may be. However, if your files are too small (generally less than 128 MB), the execution engine might be spending additional time with the overhead of opening Amazon S3 files, listing directories, getting object metadata, setting up data transfer, reading file headers, reading compression dictionaries, and so on.

Leverage bucketed tables within Athena by using Apache Spark bucketing format - This statement is incorrect. Athena does not support the Apache Spark bucketing format.

Store the data in Amazon S3 in an uncompressed format - Compressing your data can speed up your queries significantly, as long as the files are either of an optimal size (at least 128 MB), or the files are splittable. Splittable files allow the execution engine in Athena to split the reading of a single file by multiple readers to increase parallelism.

via - https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/

References:

https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/

https://docs.aws.amazon.com/athena/latest/ug/partitions.html

Domain

Design for New Solutions

Question 75Correct

A solutions architect at a retail company has set up a workflow to ingest the clickstream data into the raw zone of the S3 data lake. The architect wants to run some SQL-based data sanity checks on the raw zone of the data lake.

What AWS services would you suggest for this requirement such that the solution is cost-effective and easy to maintain?

Load the incremental raw zone data into Redshift on an hourly basis and run the SQL based sanity checks

Load the incremental raw zone data into an EMR based Spark Cluster on an hourly basis and use SparkSQL to run the SQL based sanity checks

Load the incremental raw zone data into RDS on an hourly basis and run the SQL based sanity checks

Your answer is correct

Use Athena to run SQL based analytics against S3 data

Overall explanation

Correct option:

Use Athena to run SQL based analytics against S3 data

Amazon Athena is an interactive query service that makes it easy to analyze data directly in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to set up or manage, and customers pay only for the queries they run. You can use Athena to process logs, perform ad-hoc analysis, and run interactive queries.

AWS Athena Benefits:

via - https://aws.amazon.com/athena/

Incorrect options:

Load the incremental raw zone data into Redshift on an hourly basis and run the SQL-based sanity checks - Amazon Redshift is a fully-managed petabyte-scale cloud-based data warehouse product designed for large-scale data set storage and analysis. As the development team would have to maintain and monitor the Redshift cluster size and would require significant development time to set up the processes to consume the data periodically, so this option is ruled out.

Load the incremental raw zone data into an EMR based Spark Cluster on an hourly basis and use SparkSQL to run the SQL based sanity checks - Amazon EMR is the industry-leading cloud big data platform for processing vast amounts of data using open source tools such as Apache Spark, Apache Hive, Apache HBase, Apache Flink, Apache Hudi, and Presto. Amazon EMR uses Hadoop, an open-source framework, to distribute your data and processing across a resizable cluster of Amazon EC2 instances. Using an EMR cluster would imply managing the underlying infrastructure so it’s ruled out because the correct solution for the given use case should require the least amount of development effort and ongoing maintenance.

Load the incremental raw zone data into RDS on an hourly basis and run the SQL-based sanity checks - Loading the incremental data into RDS implies data migration jobs will have to be written via a Lambda function or an EC2 based process. This goes against the requirement that the solution should involve the least amount of development effort and ongoing maintenance. Hence this option is not correct.

Reference:

https://aws.amazon.com/athena/

Domain

Accelerate Workload Migration and Modernization

Back to result overview Scroll back to top

Retake test
Continue

Fullscreen

Expanded view

Beta

0 / 10used queries