saa-c02-part-08 Flashcards
A company has global users accessing an application deployed in different AWS Regions, exposing public static IP addresses. The users are experiencing poor performance when accessing the application over the internet.
What should a solutions architect recommend to reduce internet latency?
- Set up AWS Global Accelerator and add endpoints.
- Set up AWS Direct Connect locations in multiple Regions.
- Set up an Amazon CloudFront distribution to access an application.
- Set up an Amazon Route 53 geoproximity routing policy to route traffic.
- Set up AWS Global Accelerator and add endpoints.
public static IP = Global Accelerator
poor performance = Global Accelerator
A company wants to migrate a workload to AWS. The chief information security officer requires that all data be encrypted at rest when stored in the cloud. The company wants complete control of encryption key lifecycle management.
The company must be able to immediately remove the key material and audit key usage independently of AWS CloudTrail. The chosen services should integrate with other storage services that will be used on AWS.
Which services satisfies these security requirements?
- AWS CloudHSM with the CloudHSM client
- AWS Key Management Service (AWS KMS) with AWS CloudHSM
- AWS Key Management Service (AWS KMS) with an external key material origin
- AWS Key Management Service (AWS KMS) with AWS managed customer master keys (CMKs)
- AWS Key Management Service (AWS KMS) with AWS CloudHSM
complete control of encryption key = CloudHSM
lifecycle management = KMS
https://aws.amazon.com/blogs/security/are-kms-custom-key-stores-right-for-you/
A company recently deployed a two-tier application in two Availability Zones in the us-east-1 Region. The databases are deployed in a private subnet while the web servers are deployed in a public subnet. An internet gateway is attached to the VPC. The application and database run on Amazon EC2 instances. The database servers are unable to access patches on the internet. A solutions architect needs to design a solution that maintains database security with the least operational overhead.
Which solution meets these requirements?
- Deploy a NAT gateway inside the public subnet for each Availability Zone and associate it with an Elastic IP address. Update the routing table of the private subnet to use it as the default route.
- Deploy a NAT gateway inside the private subnet for each Availability Zone and associate it with an Elastic IP address. Update the routing table of the private subnet to use it as the default route.
- Deploy two NAT instances inside the public subnet for each Availability Zone and associate them with Elastic IP addresses. Update the routing table of the private subnet to use it as the default route.
- Deploy two NAT instances inside the private subnet for each Availability Zone and associate them with Elastic IP addresses. Update the routing table of the private subnet to use it as the default route.
- Deploy a NAT gateway inside the public subnet for each Availability Zone and associate it with an Elastic IP address. Update the routing table of the private subnet to use it as the default route.
two Availability Zones = not instance because instance exists in 1 AZ = gateway
NAT Gateways = public subnets
A company has an application with a REST-based interface that allows data to be received in near-real time from a third-party vendor. Once received, the application processes and stores the data for further analysis. The application is running on Amazon EC2 instances.
The third-party vendor has received many 503 Service Unavailable Errors when sending data to the application. When the data volume spikes, the compute capacity reaches its maximum limit and the application is unable to process all requests.
Which design should a solutions architect recommend to provide a more scalable solution?
- Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.
- Use Amazon API Gateway on top of the existing application. Create a usage plan with a quota limit for the third-party vendor.
- Use Amazon Simple Notification Service (Amazon SNS) to ingest the data. Put the EC2 instances in an Auto Scaling group behind an Application Load Balancer.
- Repackage the application as a container. Deploy the application using Amazon Elastic Container Service (Amazon ECS) using the EC2 launch type with an Auto Scaling group.
- Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.
near-real time = Kinesis
A solutions architect needs to design a low-latency solution for a static single-page application accessed by users utilizing a custom domain name. The solution must be serverless, encrypted in transit, and cost-effective.
Which combination of AWS services and features should the solutions architect use? (Choose two.)
- Amazon S3
- Amazon EC2
- AWS Fargate
- Amazon CloudFront
- Elastic Load Balancer
- Amazon S3
- Amazon CloudFront
static single-page = S3
serverless = Fargate or CloudFront
low-latency = CloudFront
A company is migrating to the AWS Cloud. A file server is the first workload to migrate. Users must be able to access the file share using the Server Message Block (SMB) protocol. Which AWS managed service meets these requirements?
- Amazon Elastic Block Store (Amazon EBS)
- Amazon EC2
- Amazon FSx
- Amazon S3
3. Amazon FSx
SMB = FSx
A solutions architect is designing a customer-facing application. The application is expected to have a variable amount of reads and writes depending on the time of year and clearly defined access patterns throughout the year. Management requires that database auditing and scaling be managed in the AWS Cloud. The Recovery Point Objective (RPO) must be less than 5 hours.
Which solutions can accomplish this? (Choose two.)
- Use Amazon DynamoDB with auto scaling. Use on-demand backups and AWS CloudTrail.
- Use Amazon DynamoDB with auto scaling. Use on-demand backups and Amazon DynamoDB Streams.
- Use Amazon Redshift Configure concurrency scaling. Enable audit logging. Perform database snapshots every 4 hours.
- Use Amazon RDS with Provisioned IOPS. Enable the database auditing parameter. Perform database snapshots every 5 hours.
- Use Amazon RDS with auto scaling. Enable the database auditing parameter. Configure the backup retention period to at least 1 day.
- Use Amazon DynamoDB with auto scaling. Use on-demand backups and AWS CloudTrail.
- Use Amazon RDS with auto scaling. Enable the database auditing parameter. Configure the backup retention period to at least 1 day.
auditing and scaling be managed in the AWS Cloud = auto scaling
auditing = cloudTrail
A company has migrated an on-premises Oracle database to an Amazon RDS for Oracle Multi-AZ DB instance in the us-east-l Region. A solutions architect is designing a disaster recovery strategy to have the database provisioned in the us-west-2 Region in case the database becomes unavailable in the us-east-1 Region. The design must ensure the database is provisioned in the us-west-2 Region in a maximum of 2 hours, with a data loss window of no more than 3 hours.
How can these requirements be met?
- Edit the DB instance and create a read replica in us-west-2. Promote the read replica to master in us-west-2 in case the disaster recovery environment needs to be activated.
- Select the multi-Region option to provision a standby instance in us-west-2. The standby instance will be automatically promoted to master in us-west-2 in case the disaster recovery environment needs to be created.
- Take automated snapshots of the database instance and copy them to us-west-2 every 3 hours. Restore the latest snapshot to provision another database instance in us-west-2 in case the disaster recovery environment needs to be activated.
- Create a multimaster read/write instances across multiple AWS Regions. Select VPCs in us-east-1 and us-west-2 to make that deployment. Keep the master read/write instance in us-west-2 available to avoid having to activate a disaster recovery environment.
- Select the multi-Region option to provision a standby instance in us-west-2. The standby instance will be automatically promoted to master in us-west-2 in case the disaster recovery environment needs to be created
2 Regions = multi-Region option
A monolithic application was recently migrated to AWS and is now running on a single Amazon EC2 instance. Due to application limitations, it is not possible to use automatic scaling to scale out the application. The chief technology officer (CTO) wants an automated solution to restore the EC2 instance in the unlikely event the underlying hardware fails.
What would allow for automatic recovery of the EC2 instance as quickly as possible?
- Configure an Amazon CloudWatch alarm that triggers the recovery of the EC2 instance if it becomes impaired.
- Configure an Amazon CloudWatch alarm to trigger an SNS message that alerts the CTO when the EC2 instance is impaired.
- Configure AWS CloudTrail to monitor the health of the EC2 instance, and if it becomes impaired, trigger instance recovery.
- Configure an Amazon EventBridge event to trigger an AWS Lambda function once an hour that checks the health of the EC2 instance and triggers instance recovery if the EC2 instance is unhealthy.
- Configure an Amazon CloudWatch alarm that triggers the recovery of the EC2 instance if it becomes impaired.
automatic recovery = only the CloudWatch alarm that triggers the recovery actually tries to recover in timely manner
A solutions architect is working on optimizing a legacy document management application running on Microsoft Windows Server in an on-premises data center. The application stores a large number of files on a network file share. The chief information officer wants to reduce the on-premises data center footprint and minimize storage costs by moving on-premises storage to AWS.
What should the solutions architect do to meet these requirements?
- Set up an AWS Storage Gateway file gateway.
- Set up Amazon Elastic File System (Amazon EFS)
- Set up AWS Storage Gateway as a volume gateway
- Set up an Amazon Elastic Block Store (Amazon EBS) volume.
- Set up an AWS Storage Gateway file gateway.
Windows Server + files = Storage Gateway file gateway
A solutions architect is designing a hybrid application using the AWS cloud. The network between the on-premises data center and AWS will use an AWS Direct Connect (DX) connection. The application connectivity between AWS and the on-premises data center must be highly resilient.
Which DX configuration should be implemented to meet these requirements?
- Configure a DX connection with a VPN on top of it.
- Configure DX connections at multiple DX locations.
- Configure a DX connection using the most reliable DX partner.
- Configure multiple virtual interfaces on top of a DX connection.
- Configure DX connections at multiple DX locations.
Only 2 is highly resilient.
A company runs an application on Amazon EC2 instances. The application is deployed in private subnets in three Availability Zones of the us-east-1 Region. The instances must be able to connect to the internet to download files. The company wants a design that is highly available across the Region.
Which solution should be implemented to ensure that there are no disruptions to internet connectivity?
- Deploy a NAT instance in a private subnet of each Availability Zone.
- Deploy a NAT gateway in a public subnet of each Availability Zone.
- Deploy a transit gateway in a private subnet of each Availability Zone.
- Deploy an internet gateway in a public subnet of each Availability Zone.
- Deploy a NAT gateway in a public subnet of each Availability Zone.
instances = gateway
connect to the internet= NAT = public subnet only
Application developers have noticed that a production application is very slow when business reporting users run large production reports against the Amazon RDS instance backing the application. The CPU and memory utilization metrics for the RDS instance do not exceed 60% while the reporting queries are running. The business reporting users must be able to generate reports without affecting the application’s performance.
Which action will accomplish this?
- Increase the size of the RDS instance.
- Create a read replica and connect the application to it.
- Enable multiple Availability Zones on the RDS instance.
- Create a read replica and connect the business reports to it.
- Create a read replica and connect the business reports to it.
business reporting = queries = read replicas
A company is running a two-tier ecommerce website using services. The current architect uses a publish-facing Elastic Load Balancer that sends traffic to Amazon EC2 instances in a private subnet. The static content is hosted on EC2 instances, and the dynamic content is retrieved from a MYSQL database. The application is running in the United States. The company recently started selling to users in Europe and Australia. A solutions architect needs to design solution so their international users have an improved browsing experience.
Which solution is MOST cost-effective?
- Host the entire website on Amazon S3.
- Use Amazon CloudFront and Amazon S3 to host static images.
- Increase the number of public load balancers and EC2 instances.
- Deploy the two-tier website in AWS Regions in Europe and Australia.
- Use Amazon CloudFront and Amazon S3 to host static images.
international users have an improved browsing experience = CloudFront
A company’s website provides users with downloadable historical performance reports. The website needs a solution that will scale to meet the company’s website demands globally. The solution should be cost-effective, limit the provisioning of infrastructure resources, and provide the fastest possible response time.
Which combination should a solutions architect recommend to meet these requirements?
- Amazon CloudFront and Amazon S3
- AWS Lambda and Amazon DynamoDB
- Application Load Balancer with Amazon EC2 Auto Scaling
- Amazon Route 53 with internal Application Load Balancers
- Amazon CloudFront and Amazon S3
website demands globally = CloudFront
downloadable historical performance reports = static = S3
