Practice Exam Questions

Question 1

A company needs to ensure that its AWS cloud environment is protected from DDoS attacks. What AWS service would be the most appropriate for this requirement?

Answer 1

AWS Shield provides DDoS protection and is specifically designed to safeguard AWS applications against DDoS attacks.

Question 2

What service is primarily used for filtering traffic to applications?

Answer 2

AWS WAF is primarily used for filtering traffic to applications

Question 3

What service is a threat detection service that continuously monitors for malicious activity?

Answer 3

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity

Question 4

What service is used for security assessment and compliance of applications?

Answer 4

Amazon Inspector is used for security assessment and compliance of applications

Question 5

An application requires a database solution that can automatically scale to meet sudden increases in demand while maintaining consistent performance. What 2 AWS services would best meet these requirements and why?

Answer 5

DynamoDB with on demand capacity can automatically adjust for varying loads and ElastiCache enhances database performance through caching, handling spikes efficiently.

Question 6

What AWS service offers the most cost-effective solution for storing infrequently accessed data over a long period?

Answer 6

Amazon S3 Glacier is designed for long-term storage with infrequent access, making it the most cost-effective.

Question 7

A Solutions Architect is designing a web application that experiences seasonal traffic. To optimize costs, what combination of AWS services should be used for compute resources and why?

Answer 7

Amazon EC2 Reserved Instances provide a significant discount for predictable usage, ideal for expected seasonal traffic. Amazon EC2 Spot Instances can offer cost savings for flexible, non-critical components of the workload.

Question 8

An organization wants to secure it’s AWS infrastructure by ensuring that access keys are not embedded in code or left in accessible locations. What AWS service or feature should be used to achieve this best practice?

Answer 8

AWS Identity and Access Management (IAM) allows for the creation of roles and temporary credentials, reducing the need to store access keys within code.

Question 9

What AWS service is used for managing encryption keys?

Answer 9

AWS Key Management Service (KMS)

Question 10

What AWS service is used for tracking resource configurations and changes?

Answer 10

AWS Config

Question 11

What AWS service is used for monitoring and logging?

Answer 11

Amazon CloudWatch

Question 12

A Solutions Architect is designing a cost-optimized architecture for a workload that has predictable, consistent performance requirements. What EC2 purchasing option would be the most cost-effective?

Answer 12

Reserved instances offer significant savings for consistent, predictable workloads.

Question 13

Spot Instances are best for what type of workloads?

Answer 13

flexible, interruptible workloads

Question 14

Dedicated Hosts are typically used for what reason?

Answer 14

Compliance requirements

Question 15

A Solutions Architect needs to design a system that can handle sudden, unpredictable spikes in web traffic. What AWS service combination is the best for this requirement?

Answer 15

ASG with ELB. Auto Scaling dynamically adjusts EC2 capacity, while Elastic Load Balancing distributes traffic, effectively managing sudden spikes.

Question 16

A Solutions Architect needs to design a secure communication channel for transferring sensitive data between an Amazon EC2 instance and an S3 bucket. What combination of actions should be taken to ensure data security and why?

Answer 16

Implement server-side encryption with AWS KMS and restrict S3 bucket access with IAM roles. Server-side encryption with KMS encrypts the data at rest in S3, enhancing security. Using IAM roles to restrict bucket access ensures that only authorized EC2 instances can access the data.

Question 17

A Solutions Architect needs to improve the data processing speed of a large-scale analytics application. The current setup uses multiple EC2 instances accessing data stored in Amazon S3. What service should be implemented to enhance the processing speed without significant changes to the existing infrastructure?

Answer 17

Amazon ElastiCache can significantly improve the data processing speed by caching frequently accessed data, reducing the need to fetch it repeatedly from the S3.

Question 18

What AWS service is a fully managed NoSQL database service?

Answer 18

Amazon DynamoDB

Question 19

What is the main purpose of AWS IAM?

Answer 19

AWS IAM manages users and their levels of access to the AWS console.

Question 20

What does Amazon S3 stand for?

Answer 20

Amazon Simple Storage Service.

Question 21

What is the use of Amazon EC2?

Answer 21

EC2 provides scalable computing capacity in the AWS cloud.

Question 22

What does Auto Scaling do in AWS?

Answer 22

Auto Scaling helps you ensure that you have the correct number of EC2 instances available.

Question 23

A social photo-sharing company uses Amazon Simple Storage Service (Amazon S3) to store the images uploaded by the users. These images are kept encrypted in Amazon S3 by using AWS Key Management Service (AWS KMS) and the company manages its own AWS KMS keys for encryption. A member of the DevOps team accidentally deleted the AWS KMS key a day ago, thereby rendering the user’s photo data unrecoverable. You have been contacted by the company to consult them on possible solutions to this crisis.

As a solutions architect, what steps would you recommend to solve this issue?

Answer 23

As the AWS KMS key was deleted a day ago, it must be in the ‘pending deletion’ status and hence you can just cancel the KMS key deletion and recover the key

AWS Key Management Service (KMS) makes it easy for you to create and manage cryptographic keys and control their use across a wide range of AWS services and in your applications. AWS KMS is a secure and resilient service that uses hardware security modules that have been validated under FIPS 140-2.

Deleting an AWS KMS key in AWS Key Management Service (AWS KMS) is destructive and potentially dangerous. Therefore, AWS KMS enforces a waiting period. To delete a KMS key in AWS KMS you schedule key deletion. You can set the waiting period from a minimum of 7 days up to a maximum of 30 days. The default waiting period is 30 days. During the waiting period, the KMS key status and key state is Pending deletion. To recover the KMS key, you can cancel key deletion before the waiting period ends. After the waiting period ends you cannot cancel key deletion, and AWS KMS deletes the KMS key.

Question 24

A media agency stores its re-creatable assets on Amazon Simple Storage Service (Amazon S3) buckets. The assets are accessed by a large number of users for the first few days and the frequency of access falls down drastically after a week. Although the assets would be accessed occasionally after the first week, but they must continue to be immediately accessible when required. The cost of maintaining all the assets on Amazon S3 storage is turning out to be very expensive and the agency is looking at reducing costs as much as possible.

As an AWS Certified Solutions Architect – Associate, can you suggest a way to lower the storage costs while fulfilling the business requirements?

Answer 24

Configure a lifecycle policy to transition the objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.

Amazon S3 One Zone-IA is for data that is accessed less frequently, but requires rapid access when needed. Unlike other S3 Storage Classes which store data in a minimum of three Availability Zones (AZs), Amazon S3 One Zone-IA stores data in a single Availability Zone (AZ) and costs 20% less than Amazon S3 Standard-IA. Amazon S3 One Zone-IA is ideal for customers who want a lower-cost option for infrequently accessed and re-creatable data but do not require the availability and resilience of Amazon S3 Standard or Amazon S3 Standard-IA. The minimum storage duration is 30 days before you can transition objects from Amazon S3 Standard to Amazon S3 One Zone-IA.
Amazon S3 One Zone-IA offers the same high durability, high throughput, and low latency of Amazon S3 Standard, with a low per GB storage price and per GB retrieval fee. S3 Storage Classes can be configured at the object level, and a single bucket can contain objects stored across Amazon S3 Standard, Amazon S3 Intelligent-Tiering, Amazon S3 Standard-IA, and Amazon S3 One Zone-IA. You can also use S3 Lifecycle policies to automatically transition objects between storage classes without any application changes.

Question 25

A gaming company is looking at improving the availability and performance of its global flagship application which utilizes User Datagram Protocol and needs to support fast regional failover in case an AWS Region goes down. The company wants to continue using its own custom Domain Name System (DNS) service. What AWS services represents the best solution for this use-case?

Answer 25

**AWS Global Accelerator** ## Footnote AWS Global Accelerator utilizes the Amazon global network, allowing you to improve the performance of your applications by lowering first-byte latency (the round trip time for a packet to go from a client to your endpoint and back again) and jitter (the variation of latency), and increasing throughput (the amount of time it takes to transfer data) as compared to the public internet. AWS Global Accelerator improves performance for a wide range of applications over TCP or UDP by proxying packets at the edge to applications running in one or more AWS Regions. Global Accelerator is a good fit for non-HTTP use cases, such as gaming (UDP), IoT (MQTT), or Voice over IP, as well as for HTTP use cases that specifically require static IP addresses or deterministic, fast regional failover.

Question 26

A software engineering intern at an e-commerce company is documenting the process flow to provision Amazon EC2 instances via the Amazon EC2 API. These instances are to be used for an internal application that processes Human Resources payroll data. He wants to highlight those volume types that cannot be used as a boot volume. Can you help the intern by identifying those storage volume types that CANNOT be used as boot volumes while creating the instances?

Answer 26

**Cold Hard disk drive (sc1)** **Throughput Optimized Hard disk drive (st1)** ## Footnote The Amazon EBS volume types fall into two categories: Solid state drive (SSD) backed volumes optimized for transactional workloads involving frequent read/write operations with small I/O size, where the dominant performance attribute is IOPS. Hard disk drive (HDD) backed volumes optimized for large streaming workloads where throughput (measured in MiB/s) is a better performance measure than IOPS. Throughput Optimized HDD (st1) and Cold HDD (sc1) volume types CANNOT be used as a boot volume, so these two options are correct.

Question 27

A media company runs a photo-sharing web application that is accessed across three different countries. The application is deployed on several Amazon Elastic Compute Cloud (Amazon EC2) instances running behind an Application Load Balancer. With new government regulations, the company has been asked to block access from two countries and allow access only from the home country of the company. What configuration should be used to meet this changed requirement?

Answer 27

**Configure AWS Web Application Firewall (AWS WAF) on the Application Load Balancer in a Amazon Virtual Private Cloud (Amazon VPC)** ## Footnote You can use AWS WAF with your Application Load Balancer to allow or block requests based on the rules in a web access control list (web ACL). Geographic (Geo) Match Conditions in AWS WAF allows you to use AWS WAF to restrict application access based on the geographic location of your viewers. With geo match conditions you can choose the countries from which AWS WAF should allow access.

Question 28

The DevOps team at an e-commerce company wants to perform some maintenance work on a specific Amazon EC2 instance that is part of an Auto Scaling group using a step scaling policy. The team is facing a maintenance challenge - every time the team deploys a maintenance patch, the instance health check status shows as out of service for a few minutes. This causes the Auto Scaling group to provision another replacement instance immediately. As a solutions architect, which are the MOST time/resource efficient steps that you would recommend so that the maintenance work can be completed at the earliest? (Select two)

Answer 28

**Put the instance into the Standby state and then update the instance by applying the maintenance patch**. Once the instance is ready, you can exit the Standby state and then return the instance to service - You can put an instance that is in the InService state into the Standby state, update some software or troubleshoot the instance, and then return the instance to service. Instances that are on standby are still part of the Auto Scaling group, but they do not actively handle application traffic. **Suspend the ReplaceUnhealthy process type for the Auto Scaling group and apply the maintenance patch to the instance.** Once the instance is ready, you can manually set the instance's health status back to healthy and activate the ReplaceUnhealthy process type again - The ReplaceUnhealthy process terminates instances that are marked as unhealthy and then creates new instances to replace them. Amazon EC2 Auto Scaling stops replacing instances that are marked as unhealthy. Instances that fail EC2 or Elastic Load Balancing health checks are still marked as unhealthy. As soon as you resume the ReplaceUnhealthly process, Amazon EC2 Auto Scaling replaces instances that were marked unhealthy while this process was suspended.

Question 29

A new DevOps engineer has just joined a development team and wants to understand the replication capabilities for Amazon RDS Multi-AZ deployment as well as Amazon RDS Read-replicas. What correctly summarizes these capabilities for the given database?

Answer 29

**Multi-AZ follows synchronous replication and spans at least two Availability Zones (AZs) within a single region. Read replicas follow asynchronous replication and can be within an Availability Zone (AZ), Cross-AZ, or Cross-Region** ## Footnote Amazon RDS Multi-AZ deployments provide enhanced availability and durability for RDS database (DB) instances, making them a natural fit for production database workloads. When you provision a Multi-AZ DB Instance, Amazon RDS automatically creates a primary DB Instance and synchronously replicates the data to a standby instance in a different Availability Zone (AZ). Multi-AZ spans at least two Availability Zones (AZs) within a single region. Amazon RDS Read Replicas provide enhanced performance and durability for RDS database (DB) instances. They make it easy to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads. For the MySQL, MariaDB, PostgreSQL, Oracle, and SQL Server database engines, Amazon RDS creates a second DB instance using a snapshot of the source DB instance. It then uses the engines' native asynchronous replication to update the read replica whenever there is a change to the source DB instance. Amazon RDS replicates all databases in the source DB instance. Read replicas can be within an Availability Zone (AZ), Cross-AZ, or Cross-Region.

Question 30

An audit department generates and accesses the audit reports only twice in a financial year. The department uses AWS Step Functions to orchestrate the report creating process that has failover and retry scenarios built into the solution. The underlying data to create these audit reports is stored on Amazon S3, runs into hundreds of Terabytes and should be available with millisecond latency. As an AWS Certified Solutions Architect – Associate, what is the MOST cost-effective storage class that you would recommend to be used for this use-case?

Answer 30

**Amazon S3 Standard-Infrequent Access (S3 Standard-IA)** ## Footnote Since the data is accessed only twice in a financial year but needs rapid access when required, the most cost-effective storage class for this use-case is Amazon S3 Standard-IA. S3 Standard-IA storage class is for data that is accessed less frequently but requires rapid access when needed. S3 Standard-IA matches the high durability, high throughput, and low latency of S3 Standard, with a low per GB storage price and per GB retrieval fee. Amazon Standard-IA is designed for 99.9% availability compared to 99.99% availability of Amazon S3 Standard. However, the report creation process has failover and retry scenarios built into the workflow, so in case the data is not available owing to the 99.9% availability of Amazon S3 Standard-IA, the job will be auto re-invoked till data is successfully retrieved. Therefore this is the correct option.

Question 31

A technology blogger wants to write a review on the comparative pricing for various storage types available on AWS Cloud. The blogger has created a test file of size 1 gigabytes with some random data. Next he copies this test file into AWS S3 Standard storage class, provisions an Amazon EBS volume (General Purpose SSD (gp2)) with 100 gigabytes of provisioned storage and copies the test file into the Amazon EBS volume, and lastly copies the test file into an Amazon EFS Standard Storage filesystem. At the end of the month, he analyses the bill for costs incurred on the respective storage types for the test file. What is the correct order of the storage charges incurred for the test file on these three storage types?

Answer 31

**Cost of test file storage on Amazon S3 Standard < Cost of test file storage on Amazon EFS < Cost of test file storage on Amazon EBS** With Amazon EBS Elastic Volumes, you pay only for the resources that you use. The Amazon EFS Standard Storage pricing is $0.30 per GB per month. Therefore the cost for storing the test file on EFS is $0.30 for the month. For Amazon EBS General Purpose SSD (gp2) volumes, the charges are $0.10 per GB-month of provisioned storage. Therefore, for a provisioned storage of 100GB for this use-case, the monthly cost on EBS is $0.10*100 = $10. This cost is irrespective of how much storage is actually consumed by the test file. For S3 Standard storage, the pricing is $0.023 per GB per month. Therefore, the monthly storage cost on S3 for the test file is $0.023. Therefore this is the correct option.

Question 32

A retail company uses Amazon Elastic Compute Cloud (Amazon EC2) instances, Amazon API Gateway, Amazon RDS, Elastic Load Balancer and Amazon CloudFront services. To improve the security of these services, the Risk Advisory group has suggested a feasibility check for using the Amazon GuardDuty service. What would you identify as data sources supported by Amazon GuardDuty?

Answer 32

**VPC Flow Logs, Domain Name System (DNS) logs, AWS CloudTrail events** ## Footnote Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. With the cloud, the collection and aggregation of account and network activities is simplified, but it can be time-consuming for security teams to continuously analyze event log data for potential threats. With GuardDuty, you now have an intelligent and cost-effective option for continuous threat detection in AWS. The service uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats. Amazon GuardDuty analyzes tens of billions of events across multiple AWS data sources, such as AWS CloudTrail events, Amazon VPC Flow Logs, and DNS logs. With a few clicks in the AWS Management Console, GuardDuty can be enabled with no software or hardware to deploy or maintain. By integrating with Amazon EventBridge Events, GuardDuty alerts are actionable, easy to aggregate across multiple accounts, and straightforward to push into existing event management and workflow systems.

Question 33

The development team at an e-commerce startup has set up multiple microservices running on Amazon EC2 instances under an Application Load Balancer. The team wants to route traffic to multiple back-end services based on the URL path of the HTTP header. So it wants requests for https://www.example.com/orders to go to a specific microservice and requests for https://www.example.com/products to go to another microservice. What features of Application Load Balancers can be used for this use-case?

Answer 33

**Path-based Routing** Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, and AWS Lambda functions. If your application is composed of several individual services, an Application Load Balancer can route a request to a service based on the content of the request. Here are the different types - Host-based Routing: You can route a client request based on the Host field of the HTTP header allowing you to route to multiple domains from the same load balancer. Path-based Routing: You can route a client request based on the URL path of the HTTP header. HTTP header-based routing: You can route a client request based on the value of any standard or custom HTTP header. HTTP method-based routing: You can route a client request based on any standard or custom HTTP method. Query string parameter-based routing: You can route a client request based on the query string or query parameters. Source IP address CIDR-based routing: You can route a client request based on source IP address CIDR from where the request originates. Path-based Routing Overview: You can use path conditions to define rules that route requests based on the URL in the request (also known as path-based routing). The path pattern is applied only to the path of the URL, not to its query parameters.

Question 34

An ivy-league university is assisting NASA to find potential landing sites for exploration vehicles of unmanned missions to our neighboring planets. The university uses High Performance Computing (HPC) driven application architecture to identify these landing sites. What Amazon EC2 instance topologies should this application be deployed on?

Answer 34

**The Amazon EC2 instances should be deployed in a cluster placement group so that the underlying workload can benefit from low network latency and high network throughput** ## Footnote The key thing to understand in this question is that HPC workloads need to achieve low-latency network performance necessary for tightly-coupled node-to-node communication that is typical of HPC applications. Cluster placement groups pack instances close together inside an Availability Zone. These are recommended for applications that benefit from low network latency, high network throughput, or both. Therefore this option is the correct answer.

Question 35

One of the biggest football leagues in Europe has granted the distribution rights for live streaming its matches in the USA to a silicon valley based streaming services company. As per the terms of distribution, the company must make sure that only users from the USA are able to live stream the matches on their platform. Users from other countries in the world must be denied access to these live-streamed matches. What options would allow the company to enforce these streaming restrictions? (Select two)

Answer 35

**Use Amazon Route 53 based geolocation routing policy to restrict distribution of content to only the locations in which you have distribution rights** Geolocation routing lets you choose the resources that serve your traffic based on the geographic location of your users, meaning the location that DNS queries originate from. For example, you might want all queries from Europe to be routed to an ELB load balancer in the Frankfurt region. You can also use geolocation routing to restrict the distribution of content to only the locations in which you have distribution rights. **Use georestriction to prevent users in specific geographic locations from accessing content that you're distributing through a Amazon CloudFront web distribution** You can use georestriction, also known as geo-blocking, to prevent users in specific geographic locations from accessing content that you're distributing through a Amazon CloudFront web distribution. When a user requests your content, Amazon CloudFront typically serves the requested content regardless of where the user is located. If you need to prevent users in specific countries from accessing your content, you can use the CloudFront geo restriction feature to do one of the following: Allow your users to access your content only if they're in one of the countries on a whitelist of approved countries. Prevent your users from accessing your content if they're in one of the countries on a blacklist of banned countries. So this option is also correct.

Question 36

A healthcare startup needs to enforce compliance and regulatory guidelines for objects stored in Amazon S3. One of the key requirements is to provide adequate protection against accidental deletion of objects. As a solutions architect, what are your recommendations to address these guidelines? (Select two) ?

Answer 36

**Enable versioning on the Amazon S3 bucket** Versioning is a means of keeping multiple variants of an object in the same bucket. You can use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning-enabled buckets enable you to recover objects from accidental deletion or overwrite. **Enable multi-factor authentication (MFA) delete on the Amazon S3 bucket** To provide additional protection, multi-factor authentication (MFA) delete can be enabled. MFA delete requires secondary authentication to take place before objects can be permanently deleted from an Amazon S3 bucket. Hence, this is the correct option.

Question 37

A telecom company operates thousands of hardware devices like switches, routers, cables, etc. The real-time status data for these devices must be fed into a communications application for notifications. Simultaneously, another analytics application needs to read the same real-time status data and analyze all the connecting lines that may go down because of any device failures. As an AWS Certified Solutions Architect – Associate, what solution would you suggest, so that both the applications can consume the real-time status data concurrently?

Answer 37

**Amazon Kinesis Data Streams** ## Footnote Amazon Kinesis Data Streams enables real-time processing of streaming big data. It provides ordering of records, as well as the ability to read and/or replay records in the same order to multiple Amazon Kinesis Applications. The Amazon Kinesis Client Library (KCL) delivers all records for a given partition key to the same record processor, making it easier to build multiple applications reading from the same Amazon Kinesis data stream (for example, to perform counting, aggregation, and filtering). AWS recommends Amazon Kinesis Data Streams for use cases with requirements that are similar to the following: Routing related records to the same record processor (as in streaming MapReduce). For example, counting and aggregation are simpler when all records for a given key are routed to the same record processor. Ordering of records. For example, you want to transfer log data from the application host to the processing/archival host while maintaining the order of log statements. Ability for multiple applications to consume the same stream concurrently. For example, you have one application that updates a real-time dashboard and another that archives data to Amazon Redshift. You want both applications to consume data from the same stream concurrently and independently. Ability to consume records in the same order a few hours later. For example, you have a billing application and an audit application that runs a few hours behind the billing application. Because Amazon Kinesis Data Streams stores data for up to 365 days, you can run the audit application up to 365 days behind the billing application.

Question 38

A gaming company uses Amazon Aurora as its primary database service. The company has now deployed 5 multi-AZ read replicas to increase the read throughput and for use as failover target. The replicas have been assigned the following failover priority tiers and corresponding instance sizes are given in parentheses: tier-1 (16 terabytes), tier-1 (32 terabytes), tier-10 (16 terabytes), tier-15 (16 terabytes), tier-15 (32 terabytes). In the event of a failover, Amazon Aurora will promote what read replicas?

Answer 38

**Tier-1 (32 terabytes)** ## Footnote Amazon Aurora features a distributed, fault-tolerant, self-healing storage system that auto-scales up to 128TB per database instance. It delivers high performance and availability with up to 15 low-latency read replicas, point-in-time recovery, continuous backup to Amazon S3, and replication across three Availability Zones (AZs). For Amazon Aurora, each Read Replica is associated with a priority tier (0-15). **In the event of a failover, Amazon Aurora will promote the Read Replica that has the highest priority (the lowest numbered tier). If two or more Aurora Replicas share the same priority, then Amazon RDS promotes the replica that is largest in size.** If two or more Aurora Replicas share the same priority and size, then Amazon Aurora promotes an arbitrary replica in the same promotion tier. Therefore, for this problem statement, the Tier-1 (32 terabytes) replica will be promoted.

Question 39

A financial services company recently launched an initiative to improve the security of its AWS resources and it had enabled AWS Shield Advanced across multiple AWS accounts owned by the company. Upon analysis, the company has found that the costs incurred are much higher than expected. What would you attribute as the underlying reason for the unexpectedly high costs for AWS Shield Advanced service?

Answer 39

**Consolidated billing has not been enabled. All the AWS accounts should fall under a single consolidated billing for the monthly fee to be charged only once** ## Footnote If your organization has multiple AWS accounts, then you can subscribe multiple AWS Accounts to AWS Shield Advanced by individually enabling it on each account using the AWS Management Console or API. You will pay the monthly fee once as long as the AWS accounts are all under a single consolidated billing, and you own all the AWS accounts and resources in those accounts.

Question 40

A leading video streaming service delivers billions of hours of content from Amazon Simple Storage Service (Amazon S3) to customers around the world. Amazon S3 also serves as the data lake for its big data analytics solution. The data lake has a staging zone where intermediary query results are kept only for 24 hours. These results are also heavily referenced by other parts of the analytics pipeline. What is the MOST cost-effective strategy for storing this intermediary query data?

Answer 40

**Store the intermediary query results in Amazon S3 Standard storage class** ## Footnote Amazon S3 Standard offers high durability, availability, and performance object storage for frequently accessed data. Because it delivers low latency and high throughput, S3 Standard is appropriate for a wide variety of use cases, including cloud applications, dynamic websites, content distribution, mobile and gaming applications, and big data analytics. As there is no minimum storage duration charge and no retrieval fee (remember that intermediary query results are heavily referenced by other parts of the analytics pipeline), this is the MOST cost-effective storage class amongst the given options.

Question 41

Your developers want to run fully provisioned EC2 instances to support their application code deployments but prefer not to have to worry about manually configuring and launching the necessary infrastructure. What service should they use?

Answer 41

Elastic Beanstalk | Beanstalk provisions infrastructure, Lambda provisions services... ## Footnote Beanstalk is a managed service that abstracts the provisioning of AWS compute and networking INFRASTRUCTURE. You are required to do nothing more than push your application code, and Beanstalk automatically launches and manages all the necessary services in the background.

Question 42

What do you use as a connection between your VPC and an AWS service that enables private connectivity to the service?

Answer 42

A gateway VPC endpoint

Question 43

Some of your application's end users are complaining of delays when accessing your resources from remote geographic locations. Which service would be the most likely to help reduce delays?

Answer 43

Amazon CloudFront | "when accessing your resources from REMOTE GEOGRAPHIC LOCATIONS" ## Footnote CloudFront is Amazon's distributed global content delivery network (CDN). When properly configured, a CloudFront distribution can store cached versions of your site's content at edge locations around the world so that they can be delivered to customers on request with the greatest efficeincey and lowest latency.

Question 44

The data consumed by the application you're planning will require more speed and flexibility than you can get from a closely defined relational database structure. Which AWS database service should you choose?

Answer 44

DynamoDB ## Footnote DynamoDB provides a NoSQL database service. Both are good for workloads that can be more efficiently run without the relational schema of SQL database engines (like those, including Aurora, that are offered by (RDS)

Question 45

As you plan your multi-tiered, multi-instance AWS application, you need a way to effectively organize your instances and configure their network connectivity and access control. Which tool will let you do that?

Answer 45

Amazon Virtual Private Cloud (VPC) | Notice the question states "configure their network connectivity..." ## Footnote VPC's are virtualized network environments where you can control the connectivity of your EC2 (and RDS, etc.) infrastructure

Question 46

You want to be sure that the application you're building using EC2 and S3 resources will be reliable enough to meet the regulatory standards required within your industry. What should you check?

Answer 46

The AWS Service Level Agreement ## Footnote The AWS service level agreement tells you the level of service availability you can realistically expect from a particular AWS service. You can use this information when assessing your compliance with external standards.

Question 47

Your organization's operations team members need a way to access and administer your AWS infrastructure via your local command line or shell scripts. What tool will let them do that?

Answer 47

AWS CLI ## Footnote The AWS Command-Line Interface is a tool for accessing AWS API's from the command-line shell of your local computer.

Question 48

While building a large AWS-based application, your company has been facing configuration problems they can't solve on their own. As a result, they need direct access to AWS support for both development and IT Team leaders. Which support plan should you purchase?

Answer 48

Business ## Footnote Unlike the Basic and Developer plans (which allow access to a support associate to no or one user, respectively), the Business plan allows multiple team members.

Question 49

You've got a complex, multi-tiered application running on local servers that you want to migrate to the cloud. Which tool will provide you with the specific tools you will need to move the application with the least risk and the least disruption?

Answer 49

AWS Application Migration Service ## Footnote Application Migration Service can automate the testing and transfer of AWS-bound migrations of your non-cloud application servers.

Question 50

What service enables you to securely connect your on-premises network or branch office site to your Amazon Virtual Private Cloud (Amazon VPC).

Answer 50

AWS Site-to-Site VPN

Question 51

Which feature of an Amazon S3 bucket can only be suspended and not disabled once it have been enabled?

Answer 51

Versioning

Question 52

What service is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale.

Answer 52

Amazon API Gateway

Question 53

________ act as the front door for applications to access data, business logic, or functionality from your backend services.

Answer 53

APIs

Question 54

Using ____________, you can create RESTful APIs and WebSocket APIs that enable real-time two-way communication applications.

Answer 54

API Gateway

Question 55

You would like to have a distributed POSIX compliant file system that will allow you to maximize the IOPS in order to perform some High-Performance Computing (HPC) and genomics computational research. This file system has to easily scale to millions of IOPS. What do you recommend?

Answer 55

Amazon FSx for Lustre

Question 56

Which deployment option in the FSx file system provides you with long-term storage that's replicated within AZ?

Answer 56

Persistent File System

Question 57

Which service is managed service for file transfers into and out of S3 or EFS using the FTP protocol, thus TLS is not supported.

Answer 57

AWS Transfer Family

Question 58

A company uses a lot of files and data which is stored in an FSx for Windows File Server storage on AWS. Those files are currently used by the resources hosted on AWS. There’s a requirement for those files to be accessed on-premises with low latency. Which AWS service can help you achieve this?

Answer 58

FSx File Gateway

Question 59

A Solutions Architect is working on planning the migration of a startup company from on-premises to AWS. Currently, their infrastructure consists of many servers and 30 TB of data hosted on a shared NFS storage. He has decided to use Amazon S3 to host the data. Which AWS service can efficiently migrate the data from on-premises to S3?

Answer 59

AWS DataSync

Question 60

Which AWS service is best suited to migrate a large amount of data from an S3 bucket to an EFS file system?

Answer 60

AWS DataSync

Question 61

A Machine Learning company is working on a set of datasets that are hosted on S3 buckets. The company decided to release those datasets to the public to be useful for others in their research, but they don’t want to configure the S3 bucket to be public. And those datasets should be exposed over the FTP protocol. What can they do to do the requirement efficiently and with the least effort?

Answer 61

Use AWS Transfer Family

Question 62

Which AWS service is best suited when migrating from an on-premises ZFS file system to AWS?

Answer 62

Amazon FSx for OpenZFS

Question 63

A company is running Amazon S3 File Gateway to host their data on S3 buckets and is able to mount them on-premises using SMB. The data currently is hosted on S3 Standard storage class and there is a requirement to reduce the costs for S3. So, they have decided to migrate some of those data to S3 Glacier. What is the most efficient way they can use to move the data to S3 Glacier automatically?

Answer 63

Use S3 Lifecycle Policy

Question 64

You have on-premises sensitive files and documents that you want to regularly synchronize to AWS to keep another copy. Which AWS service can help you with that?

Answer 64

AWS DataSync

Question 65

_____________ is an online data transfer service that simplifies, automates, and accelerates moving data between on-premises storage systems and AWS Storage services, as well as between AWS Storage services.

Answer 65

AWS DataSync

Question 66

You have a CloudFront Distribution that serves your website hosted on a fleet of EC2 instances behind an Application Load Balancer. All your clients are from the United States, but you found that some malicious requests are coming from other countries. What should you do to only allow users from the US and block other countries?

Answer 66

Use CloudFront Geo Restriction

Question 67

You have a static website hosted on an S3 bucket. You have created a CloudFront Distribution that points to your S3 bucket to better serve your requests and improve performance. After a while, you noticed that users can still access your website directly from the S3 bucket. You want to enforce users to access the website only through CloudFront. How would you achieve that?

Answer 67

Configure your CloudFront Distribution to create an Origin Access Control (OAC), then update your S3 bucket policies to only accept requests from your CloudFront Distribution.

Question 69

Many companies that distribute content over the internet want to restrict access to documents, business data, media streams, or content that is intended for selected users, for example, users who have paid a fee. To securely serve this private content you can do what two things?

Answer 69

1. Require that your users access your private content by using special CloudFront signed URL’s or signed cookies 2. Require that your users access your content by using CloudFront URLs to prevent users from bypassing the restrictions that you specify in signed URLs or signed cookies.

Question 70

______________ is an Origin Protocol Policy that configures CloudFront to communicate with your origin using HTTP or HTTPs, depending on the protocol of the viewer request.

Answer 70

Match Viewer

Question 71

___________ provides multiple directory choices for customers who want to use existing Microsoft AD or LDAP-aware applications in the cloud.

Answer 71

AWS Directory Service

Question 72

If we need to monitor how the different processes or threads on a DB instance use the CPU, should we use CloudWatch or RDS Enhanced Monitoring?

Answer 72

RDS Enhanced Monitoring, CloudWatch gathers metrics about CPU utilization from the hypervisor for a DB instance. *Although you can use Amazon CloudWatch, the data provided by CloudWatch is not as detailed as compared with the Enhanced Monitoring feature of RDS.