sap full2 Flashcards
(489 cards)
1
Q
How long does it take to get data out of Glacier?
A
It can take AT LEAST 3 hours
2
Q
What storage type provides the ability to create point-in-time snapshots of data volumes?
A
EBS
3
Q
Which three services have automated backups?
A
RDS
Elasticache (Redis only)
Redshift
4
Q
Which service does not have automated backups?
A
EC2
5
Q
In Read Replicas vs Multi-AZ; Which is used for scaling?
A
Read Replicas
6
Q
In Read Replicas vs Multi-AZ; Which is used for DR?
A
Multi-AZ
7
Q
How many read replicas can you have?
A
Up to 5
8
Q
Can you have read replicas in different regions?
A
Yes - With the exception of SQL Server and Oracle
9
Q
Are read replicas synchronous or asynchronous?
A
Asynchronous
10
Q
[T/F] Read Replicas can be made off of Multi-AZ’s database
A
t
11
Q
[T/F] Read Replicas can be in Multi-AZ.
A
t
12
Q
Can you have a read replica of a read replica? Will this increase latency?
A
Yes, but only for MySQL and this will increase latency
13
Q
DB Snapshots and Automated backups [can/cannot] be taken of read replicas.
A
Can - but are not enabled by default
14
Q
If you application does not require transaction support, Atomicity, Consistency, Isolation, Durability (ACID) compliance, joins & SQL… What should you consider using instead of RDS?
A
DynamoDB
15
Q
What are the 4 different Storage Gateway Types?
A
File Gateway
Gateway-Cached Volumes
Gateway-Stored Volumes
Gateway-Virtual Tape Library
16
Q
How long does it take to access virtual tapes in your virtual tape library?
A
Instantaneous
17
Q
How long does it take to access your virtual tapes from your virtual tape shelf?
A
It can take 24 hours
18
Q
How is Storage Gateway encrypted?
A
Encrypted using SSL for transit
Encrypted at rest in S3 using AES-256
19
Q
How are Gateway-Stored Volumes stored?
A
Stored data as Amazon EBS Snapshots in S3.
20
Q
Gateway Storage snapshots [can/cannot] be scheduled.
A
Gateway Storage Volumes can be scheduled.
21
Q
Gateway Storage bandwidth [can/cannot] be throttled.
A
Gateway storage can be throttled - which is great for remote sites
22
Q
_______ make it easy to group your resources using the tags that are assigned to them. You can group resources that share one or more tags.
A
Resource groups
23
Q
_________ allows you to get volume discounts on all your accounts.
A
Consolidated billing
24
Q
With consolidated billing, _____ is on a per account and per region basis but can be aggregated into a single bucket in the paying account.
A
CloudTrail
25
The contract length for Reserved Instances is between __ and __ years.
1 & 3
26
What are the 3 types of RIs?
#NAME?
27
Which of the RIs offers the largest discount?
All Upfront RIs
28
Standard RIs for EC2 can be modified, but only if they are in the same _______ and only if the ______ factors are equal and only for the Linux operating system.
Family; Normalization;
29
You can switch EC2 RIs between \_\_\_\_\_\_, but not between \_\_\_\_\_\_.
AZs; Regions
30
EC2 RIs [can/cannot] be sold on the marketplace.
can
31
Can you have reserved RDS instances?
Yes
32
With RDS reserved instances, you can move ______ but not \_\_\_\_\_\_\_.
AZ's but not regions.
33
Elastic Beanstalk [can/cannot] provision RDS instances.
can
34
Elastic Beanstalk [does/does not] support IAM.
does
35
You have ___ access to the resources under Elastic Beanstalk.
full
36
Elastic Beanstalk code is stored in \_\_\_.
S3
37
With Elastic Beanstalk, ________ environments are allowed to support version control.
multiple
38
Elastic Beanstalk [can/cannot] roll back changes.
can
39
With Elastic Beanstalk, ______ the changes from ____ repositories are replicated.
Only the changes from Git repositories
40
Amazon Elastic Beanstalk supports which AMIs?
Linux AMI & Windows 2012 R2
41
OpsWork consists of ________ and \_\_\_\_\_\_\_\_.
Stacks; Layers
42
OpsWorks runs on \_\_\_\_\_.
Chef
43
In OpsWork, layers contain AWS resources such as...
EC2 ELB RDS
44
In OpsWork, layers are like \_\_\_\_\_, \_\_\_\_\_\_, and _______ layer.
Web; Application; Database
45
In OpsWork, each stack will have how many layers?
1 or more
46
What happens to any EC2 instance added outside of the OpsWork stack in ELB?
OpsWork will remove
47
CloudFormation uses ________ to resolve dependency between resource creation.
wait condition
48
What is mandatory for a CloudFormation template?
Resources
49
With CloudFormation, you can create multiple ____ inside of one template.
VPCs
50
If you wanted to connect VPCs in your CloudFormation template. You can enable _____________ using CloudFormation.
VPC Peering
51
CloudFormation supports \_\_\_\_\_, \_\_\_\_\_\_\_\_, and _____ scripts.
Chef; Puppet; Bootstrap
52
With CloudFormation, you can use ________ to output data.
Fn:GetAtt
53
By default, the _______________ feature is enabled in CloudFormation.
"automatic rollback on error"
54
CloudFormation itself costs what?
Nothing
55
\_\_\_\_\_\_\_ is completely supported with CloudFormation. This includes creating new hosted zones or updating existing ones.
Route53
56
If you are accessing services using HTTPs endpoints (think DynamoDB, S3) use public \_\_\_\_.
VIFs
57
Direct Connect. If you are accessing VPCs using private IP address ranges, use private \_\_\_\_\_\_.
VIFs
58
In the US, you need ___ direct connect connection(s) to connect to all 4 US regions.
1
59
Does data transferred between regions go over public internet?
No
60
Layer 2 connections [are/are not] supported by direct connect.
Are not
61
What is the difference between a Customer Gateway and a Virtual Private Gateway?
Customer Gateway - Customer side Virtual Private Gateway - AWS Side
62
Which ports does EC2-VPC ELB support?
1-65536
63
Can you assign an Elastic IP to an Elastic Load Balancer?
No
64
You can load balance to the _________ of your domain name with ELBs.
Zone Apex
65
If you have multiple SSL certifications you should use ________ Elastic Load Balancers, unless you have a wildcard certificate.
Multiple
66
A placement group [can/cannot] span availability zones but it [can/cannot] span subnets, provided that they are in the same VPC.
cannot; can
67
You [can/cannot] move existing instances to placement groups.
cannot
68
How can you reduce bottlenecks with NATs?
Scale up and Scale out; If you scale out, add an additional NAT & subnet and migrate half your workload to the new subnet.
69
Can you peer VPCs from different regions?
YES
70
If you peer two VPCs, what needs to be updated?
Security groups & make sure that a route table has been created in both VPCs to allow traffic.
71
If your application is more oriented toward indexing and querying data, it may be better to use this Amazon DB for your needs.
DynamoDB
72
If your application has number BLOB data (binary large objects) then what would be a good choice for storage?
S3
73
If you need fully automated scaling, which DB is best?
DynamoDB
74
If you're looking to scale your database up you should use \_\_\_\_\_\_\_\_, if you're looking to scale out use \_\_\_\_\_\_\_\_.
RDS; DynamoDB
75
Databases that require Joins and/or complex transactions should look to utilize what database options with AWS?
Amazon RDS or Amazon EC2 with self-managed database
76
If you plan to store very large amounts of data that are infrequently accessed (Low I/O rates) where should you store that data?
S3
77
Use _______ to optimize both GETs & PUTs with S3.
Parallelization
78
S3 stores data in __________ order so you have to __________ the data.
Lexicographical; randomize
79
You can secure S3 by doing what 3 things?
#ERROR!
80
CloudHSM is _____ tenanted.
Single Tenanted (1 physical device, for you only)
81
CloudHSM must be used in \_\_\_\_\_.
a VPC
82
You can use ___________ to connect o a CloudHSM from another VPC.
VPC Peering
83
IF you need fault tolerance with your CloudHSM, you need to build a \_\_\_\_\_\_\_\_.
Cluster
84
Which databases & warehouses CloudHSM can integrate with:
* RDS (Oracle & SQL)
* Redshift
85
You monitor CloudHSM via \_\_\_\_\_\_.
Syslog
86
The two types of directory services are ____ and \_\_\_\_\_\_\_\_.
AD Connector; Simple AD
87
By default, CloudWatch Logs will store your log data for how long?
Indefinitely
88
The default CloudWatch Alarm History is only how many days?
14
89
Step 1 of 3 for developing an Identity Broker is:
Develop an Identity Broker to communicate with LDAP & AWS STS
90
Step 2 of 3 for developing an Identity Broker is:
Identity Broker always communicates with LDAP first, THEN with AWS STS
91
Step 3 of 3 for developing an Identity Broker is:
Application then gets temporary access to AWS resources.
92
AWS Security Token Service returns which four values upon request for a federated token?
A Token
A Secret Access Key
Access Key ID
A Duration
93
True or False: To minimize the attack surface area, servers can be placed behind a bastion host, through which all traffic must pass.
94
If you want Intrusion Prevention AND Intrusion Detection you should use what?
A IPS tool
95
SNS Can SNS push notification to mobile devices (“Mobile Pushâ€)?
Yes
96
What elements of a CloudFormation template are required?
Resources
97
How can I configure a CloudFormation template to pause while an application is configured on a template-created EC2 instance?
Using wait conditions
Using creation policies
cfn-signal CreationPolicies are the preferred mechanism
98
Can you copy EBS snapshots across regions?
Yes
99
ElasticBeanstalk rolling update types
#ERROR!
100
ElasticBeanstalk environment types
#NAME?
101
How to preserve/backup CloudFormation resource when the stack is deleted
DeletionPolicy attribute
102
In which parts of CloudFormation template can intristic function be used?
resource properties,
outputs,
metadata attributes
update policy attributes
103
Simple, automated way to back up data stored on Amazon EBS volumes
Amazon Data Lifecycle Manager (DLM) for EBS Snapshots
104
Two ways to install security update on the running OpsWorks instances
- Create and start new instances to replace your current online instances. Then delete the current instances. - On Linux-based instances in Chef 11.10 or older stacks, run the Update Dependencies stack command
105
What is CFN Hup?
The cfn-hup helper is a daemon that detects changes in resource metadata and runs user-specified actions when a change is detected.
106
Three CI/CD stages
#NAME?
107
ElasticBeanstalk source bundle requirements
- Consist of a single ZIP file or TAR file
- Not exceed 512 MB
- Not include a parent folder or top-level directory
108
Describe durability in Kinesis
Kinesis synchronously replicates the streaming data across three data centres within single AWS region and preserves the data for up to 24H
109
How do you scale Kinesis?
Adding more shards
110
What's the processing rate of 1 shard in Kinesis
1MB/sec data input and 2MB/sec data output
111
Which CloudFormation resource is used to create nested stacks?
AWS::CloudFormation::Stack
112
Three source repositories of CodeDeploy
#NAME?
113
Two types of deployments in CodeDeploy
#NAME?
114
Directory for awslogs service
/etc/awslogs/
115
What is the maximum amount of data that can be stored in a Gateway-Stored volume?
16TB
116
How to ensure Redshift is capable of parallel processing?
By configuring workload management (WLM) in Amazon Redshift
117
What is HLS?
HTTP Live Streaming - protocol that segments media files for optimization during streaming. HLS enables media players to play segments with the highest quality resolution that is supported by their network connection during playback
118
What is WOWZA Streaming Engine
Wowza Streaming Engine is the gold standard of customizable streaming server software for building and delivering professional-grade streaming at any scale
119
Can you modify DHCP options in VPC?
If you want your VPC to use a different set of DHCP options, you must create a new set and associate them with your VPC.
120
What to do when you receive a capacity error when launching an instance in a placement group
stop and start all of the instances in the placement group, and try the launch again
121
Can read replica of RDS on VMware be assigned ty any region?
YES
122
Two use cases for HLS
view an Amazon Kinesis video stream for: - live playback - view archived video
123
Is retention schedule carried over to the snapshot copy?
NO
124
When can you enable EFS encryption at rest?
When creating EFS file system
125
When can you enable encryption in transit on EFS
When mounting the EFS volume
126
Can you snapshot instance-store volume?
NO. Other method need to be used (backing up to EBS)
127
What is TLS?
Transport Layer Security
128
What is ETL shortcut form?
Extract, transform, load
129
Where you can put policy variables in CF?
#ERROR!
130
Default maximum number of customer managed policies in an AWS account
1500
131
Default maximum number of Groups in AWS account
300
132
Default maximum number of roles in AWS account
1000
133
Maximum number of users in AWS account
5000 (and cannot be changed)
134
3 Support plans in AWS
#NAME?
135
Which AWS support plan has an access to TAM (Technical Account Manager)
#ERROR!
136
What is Amazon Neptune?
Fully managed graph database. Supports open graphs APIs for both Gremlin and SPARQL
137
What's the benefit of using Elasticache for Web Sessions?
In cases with load-balanced web servers, store web session information in Redis so if a server is lost, the session info is not lost and another web server can pick it up.
138
What's the benefit of using Elasticache for Databases?
Use Memcache in front of AWS RDS to cache popular queries to offload work from RDS and return results faster to users
139
Which caching engine support encryption?
Redis
140
Which caching engine is HIPAA compliant?
Redis
141
Which caching engine support clustering?
Redis
142
Which caching engine you should use when complex data type is required?
Redis
143
what is Amazon Athena?
SQL Engine overlaid on S3, based on Presto
144
Which Database is based on blockchain concepts?
Amazon Quantum Ledger Database
145
What is AWS Service Catalog?
Framework allowing administrators to create pre-defined products and landscapes for their users
146
How data is processed in Kinesis?
In shards
147
What's Shard performance in Kinesis?
1000 records per second
148
Deafult Shard limit in Kinesis?
500 shards - can be increased to unlimited
149
What Kinesis Shard record consist of?
- Partition Key
- Sequence Number
- Data Blob (up to 1MB)
150
What is DynamoDB DAX
DynamoDB Accelerator
151
How dynamic content is delivered in CloudFront?
HTTP cookies forwarded from an origin
152
What is Amazon MQ?
Managed implementation of Apache ActiveMQ
153
What are available a Amazon Neptune endpoints?
#NAME?
154
What is Amazon Neptune Cluster endpoint?
A cluster endpoint is an endpoint for a Neptune DB cluster that connects to the current primary DB instance for that DB cluster. Each Neptune DB cluster has a cluster endpoint and one primary DB instance
155
What is Amazon Neptune Reader endpoint?
A reader endpoint is an endpoint for a Neptune DB cluster that connects to one of the available Neptune replicas for that DB cluster. Each Neptune DB cluster has a reader endpoint
156
What is Amazon Neptune Instance endpoint?
An instance endpoint is an endpoint for a DB instance in a Neptune DB cluster that connects to that specific DB instance. Each DB instance in a DB cluster, regardless of instance type, has its own unique instance endpoint
157
Database engine behind Redshift
PostgreSQL
158
What ETL stand for
#NAME?
159
Nodes in Redshift Cluster
#ERROR!
160
Performance features of Redshift
#ERROR!
161
What is the main difference between QLDB and blockchain?
In blockchain, the ledger is distributed, whereas in QLDB, is is centralized.
162
What partition key is composed of in Cassandra?
a partition key and one or more columns
163
What Amazon Keyspaces is compatible with?
Apache Cassandra
164
Where QLDB database is placed into?
Amazon Ion documents
165
Which type of storage used in QLDB is used to provision the tables and indexes within the ledger database?
index storage
166
Three types of node in EMR
#NAME?
167
What HDFS stand for?
Hadoop Distributed File System
168
What is a step execution mode in EMR?
The cluster starts, runs the "steps" (tasks) and terminates itself.
169
What is Launch execution mode?
Cluster can accept and execute tasks you submit
170
Which instance family provides access to graphics processing units (GPUs) and field programmable gate arrays (FPGAs)?
Accelerated Computing
171
What is a common use case for Amazon Lightsail?
to host simple websites, blogs or small applications
172
What must be running on your container instances so that they can register into an Amazon ECS cluster?
The Amazon ECS container agent
173
What is a unit of work for AWS Batch to complete?
a job
174
What can occur when a user requests to restore an S3 object that has been archived in Amazon Glacier?
Amazon Glacier creates a temporary copy of the object in S3-RRS storage class.
175
In Amazon CloudFront, when using a network of edge locations around the world, requests for your dynamic content are ...
sent to your origin servers running within or outside of AWS.
176
At what level can Amazon S3 Access Control Lists (ACLs) be applied?
the bucket and object level
177
A user has created a new EBS volume. The user wants to mount the volume on the instance to which it is attached. Which step is required before the user can mount the volume?
The user must create a file system on the volume.
178
How is an Amazon EFS mount target configured within your AWS infrastructure?
A mount target must be placed within a VPC to communicate with EC2 instances in that VPC
179
A user has launched a dedicated EBS-backed instance. You are curious where the EBS volume for this instance will be created.
The EBS volume will not be created on the same tenant hardware assigned to the dedicated instance.
180
In Amazon Elastic File System (EFS), what is used to load data that is presently not stored on the Amazon cloud?
AWS DataSync
181
How do you indicate where to send your Snowball once your data has been loaded to it?
Turn it off. The E Ink will display changes to the return label. Then ship it to Amazon.
182
How long does Amazon Glacier's expedited retrieval take?
Amazon Glacier takes 1-5 minutes to retrieve data.
183
What is a "Key" for an Amazon S3 object?
A unique identifier for an object in a bucket
184
Where does Amazon EFS store its data?
A file system
185
What is the potential size range for individual objects stored in Amazon S3?
0 bytes to 5 TB
186
Which encryption method does AWS Storage Gateway use to encrypt all data by default?
Server-side encryption with S3-managed keys (SSE-S3)
187
Does EMR provide detailed CloudWatch monitoring?
No
188
What "Elasticity" mean in AWS?
Elasticity is the ability to grow or shrink infrastructure resources dynamically as needed to adapt to workload changes in an autonomic manner, maximizing the use of resources. This can result in savings in infrastructure costs overall
189
How can you keep data in Kinesis for more than 24H?
Enabling "extended data retention".
190
When you put objects in Amazon S3, what is the indication that an object was successfully stored?
A HTTP 200 result code and MD5 checksum, taken together, indicate that the operation was successful.
191
When you resize the Amazon RDS DB instance, Amazon RDS will perform the upgrade during the next maintenance window. If you want the upgrade to be performed now, rather than waiting for the maintenance window, specify the option.
ApplyImmediately
192
What is the default maximum number of VPCs allowed per region?
5
193
In Amazon IAM, what is the maximum length for a role name?
64 characters
194
How many users can open technical support cases under the AWS Business and Enterprise support plan?
Unlimited
195
Amazon Cognito has two different flows for authentication with public providers. Which are the two flows?
Enhanced and basic
196
case-insensitive matching of the ARN
ArnLike
197
When does an AWS Data Pipeline terminate the AWS Data Pipeline-managed compute resources?
When the final activity that uses the resources has completed successfully or failed
198
A user is configuring MySQL RDS with PIOPS. What should be the minimum size of DB storage provided by the user?
100GB
199
What's the max number of automatic retries in Data Pipeline
10
200
True or False: Amazon ElastiCache supports the Redis key-value store.
t
201
Does Amazon RDS API provide actions to modify DB instances inside a VPC and associate them with DB Security Groups?
YES
202
By default, what is the maximum number of Cache Nodes you can run in Amazon ElastiCache?
20
203
Which component of AWS Data Pipeline specifies the business logic of your data management?
Pipeline definition
204
What feature of the load balancing service attempts to force subsequent connections to a service to be redirected to the same node as long as it is online?
Session persistence
205
What types of identities do Amazon Cognito identity pools support?
They support both authenticated and unauthenticated identities.
206
Two types of jobs that can trigger SNS notification in AWS glacier
#ERROR!
207
What is the maximum length for an instance profile name in AWS IAM?
128 characters
208
What is the maximum length for a certificate ID in AWS IAM?
128 characters
209
Provisioned IOPS SSD size range
4GB - 15TB
210
If a single condition within an IAM policy includes multiple values for one key, it will be evaluated using a logical\_\_\_\_\_\_
OR
211
By default, temporary security credentials for an IAM user are valid for a maximum of 12 hours, but you can request a duration as long as _________ hours
36
212
How does AWS Data Pipeline execute activities on on-premise resources or AWS resources that you manage?
By supplying a Task Runner package that can be installed on your on-premise hosts
213
Which IAM policy element lets you specify an exception to a list of actions?
NotAction
214
Which RAID setup is not recommended for Amazon EBS?
RAID 5 and RAID 6
215
What is the maximum ratio the user should configure between PIOPS and the volume size?
30
216
Can Provisioned IOPS be used on RDS instances launched in a VPC?
Yes, they can be used for all RDS instances.
217
Which component of AWS Data Pipeline polls for tasks and then performs those tasks?
Task Runner
218
Default cache ports
for Memcached 11211 and for Redis 6379
219
Can you configure multiple Load Balancers with a single Auto Scaling group?
YES
220
Can a user configure a custom health check with Auto Scaling?
YES
221
To scale out the AWS resources using manual AutoScaling, which parameter should the user change?
Desired capacity
222
Which EC2 functionality allows the user to place the Cluster Compute instances in clusters?
Cluster placement group
223
Which system is used by Amazon Machine Images paravirtual (PV) virtualization during the boot process?
PV-GRUB
224
Will you be able to access EC2 snapshots using the regular Amazon S3 APIs?
No, snapshots are only available through the Amazon EC2 APIs.
225
When using the AWS CLI for AWS CloudFormation, which command returns a description of the specified resource in the specified stack?
describe-stack-resource
226
For Amazon EC2 issues, while troubleshooting AWS CloudFormation, you need to view the cloud-init and cfn logs for more information. Identify a directory to which these logs are published.
/var/log/
227
Is it possible to load data from Amazon DynamoDB into Amazon Redshift?
YES
228
What's the minimum PIOPS disk sizes?
4 GB for EBS io1, 100GB for RDS - Provisioned IOPS
229
the only way to attach instance store volumes to an instance
block device mapping to attach the volumes as the instance is launched
230
Maximum size of Gateway-Cached volumes?
**1,024TB**
231
Maximum size of Gateway-stored volume?
**512 TB**
232
Can SSL private certificte be used directly on EC2
NO
233
Can SSL public certificte be used directly on EC2
no
234
Auto-scaling method used for ECS?
Service Auto Scaling
235
3 options in CloudFront that you can choose as the value for your Origin Protocol Policy
#ERROR!
236
Difference between a NAT Instance and a NAT Gateway when handling a timeout
NAT Instance - When there is a connection time out, a NAT instance sends a FIN packet to resources behind the NAT instance to close the connection.
NAT Gateway - When there is a connection time out, a NAT gateway returns an RST packet to any resources behind the NAT gateway that attempt to continue the connection (it does not send a FIN packet).
237
Cached volume sizes
Cached volumes can range from 1 GiB to 32 TiB in size and must be rounded to the nearest GiB. Each gateway configured for cached volumes can support up to 32 volumes for a total maximum storage volume of 1,024 TiB (1 PiB).
238
What HTTP 504 errors mean?
An HTTP 504 gateway timeout error does not necessarily indicate a problem with your cluster—it just means that the request couldn't be completed within the idle timeout period.
239
What's the SCP policy attached by default to every root, OU and account in Organizations?
FullAWSAccess
240
Can HDD (cold) volume be used as a bootable volume?
NO
241
Cookie name used by ELB to map session to the instance
AWSELB
242
How to collect both logs and advanced metrics from Amazon EC2 instances and on-premises servers into CloudWatch Logs
use the unified CloudWatch agent
243
What is OpsWorks auto-healing?
Every instance has an AWS OpsWorks Stacks agent that communicates regularly with the service. AWS OpsWorks Stacks uses that communication to monitor instance health. If an agent does not communicate with the service for more than approximately five minutes, AWS OpsWorks Stacks considers the instance to have failed.
244
How to stop sharing RI in AWS Organizations?
Turn off RI sharing for member account in that Organization
245
A company needs to architect a hybrid DNS solution. This solution will use an Amazon Route 53 private hosted zone for the domain cloud.example.com for the resources stored within VPCs.
The company has the following DNS resolution requirements:
On-premises systems should be able to resolve and connect to cloud.example.com.
All VPCs should be able to resolve cloud.example.com.
There is already an AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway.
Which architecture should the company use to meet these requirements with the HIGHEST performance?
Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
246
A company is providing weather data over a REST-based API to several customers. The API is hosted by Amazon API Gateway and is integrated with different AWS Lambda functions for each API operation. The company uses Amazon Route 53 for DNS and has created a resource record of weather.example.com. The company stores data for the API in Amazon DynamoDB tables. The company needs a solution that will give the API the ability to fail over to a different AWS Region.
Which solution will meet these requirements?
Deploy a new API Gateway API and Lambda functions in another Region. Change the Route 53 DNS record to a failover record. Enable target health monitoring. Convert the DynamoDB tables to global tables.
247
A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the organization to manage access to restricted services.
The company recently acquired a new business unit and invited the new unit’s existing AWS account to the organization. Once onboarded, the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the company’s policies.
Which option will allow administrators to make changes and continue to enforce the current policies without introducing additional long-term maintenance?
Create a temporary OU named Onboarding for the new account. Apply an SCP to the Onboarding OU to allow AWS Config actions. Move the organization’s root SCP to the Production OU. Move the new account to the Production OU when adjustments to AWS Config are complete.
248
A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application. The application connects to a PostgreSQL database running on a separate server. The application’s user base is expected to grow significantly, so the company is migrating the application and database to AWS. The solution will use Amazon Aurora PostgreSQL, Amazon EC2 Auto Scaling, and Elastic Load Balancing.
Which solution will provide a consistent user experience that will allow the application and database tiers to scale?
Enable Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing and sticky sessions enabled.
249
A company uses a service to collect metadata from applications that the company hosts on premises. Consumer devices such as TVs and internet radios access the applications. Many older devices do not support certain HTTP headers and exhibit errors when these headers are present in responses. The company has configured an on-premises load balancer to remove the unsupported headers from responses sent to older devices, which the company identified by the User-Agent headers.
The company wants to migrate the service to AWS, adopt serverless technologies, and retain the ability to support the older devices. The company has already migrated the applications into a set of AWS Lambda functions.
Which solution will meet these requirements?
Create an Amazon CloudFront distribution for the metadata service. Create an Application Load Balancer (ALB). Configure the CloudFront distribution to forward requests to the ALB. Configure the ALB to invoke the correct Lambda function for each type of request. Create a CloudFront function to remove the problematic headers based on the value of the User-Agent header.
250
A company is running a traditional web application on Amazon EC2 instances. The company needs to refactor the application as microservices that run on containers. Separate versions of the application exist in two distinct environments: production and testing. Load for the application is variable, but the minimum load and the maximum load are known. A solutions architect needs to design the updated application with a serverless architecture that minimizes operational complexity.
Which solution will meet these requirements MOST cost-effectively?
Upload the container images to Amazon Elastic Container Registry (Amazon ECR). Configure two auto scaled Amazon Elastic Container Service (Amazon ECS) clusters with the Fargate launch type to handle the expected load. Deploy tasks from the ECR images. Configure two separate Application Load Balancers to direct traffic to the ECS clusters.
251
A company has a multi-tier web application that runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The ALB and the Auto Scaling group are replicated in a backup AWS Region. The minimum value and the maximum value for the Auto Scaling group are set to zero. An Amazon RDS Multi-AZ DB instance stores the application’s data. The DB instance has a read replica in the backup Region. The application presents an endpoint to end users by using an Amazon Route 53 record.
The company needs to reduce its RTO to less than 15 minutes by giving the application the ability to automatically fail over to the backup Region. The company does not have a large enough budget for an active-active strategy.
What should a solutions architect recommend to meet these requirements?
Create an AWS Lambda function in the backup Region to promote the read replica and modify the Auto Scaling group values. Configure Route 53 with a health check that monitors the web application and sends an Amazon Simple Notification Service (Amazon SNS) notification to the Lambda function when the health check status is unhealthy. Update the application’s Route 53 record with a failover policy that routes traffic to the ALB in the backup Region when a health check failure occurs.
252
A company is hosting a critical application on a single Amazon EC2 instance. The application uses an Amazon ElastiCache for Redis single-node cluster for an in-memory data store. The application uses an Amazon RDS for MariaDB DB instance for a relational database. For the application to function, each piece of the infrastructure must be healthy and must be in an active state.
A solutions architect needs to improve the application's architecture so that the infrastructure can automatically recover from failure with the least possible downtime.
Which combination of steps will meet these requirements?
Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances. Ensure that the EC2 instances are part of an Auto Scaling group that has a minimum capacity of two instances.
Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones.
Create a replication group for the ElastiCache for Redis cluster. Enable Multi-AZ on the cluster.
253
A retail company is operating its ecommerce application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses an Amazon RDS DB instance as the database backend. Amazon CloudFront is configured with one origin that points to the ALB. Static content is cached. Amazon Route 53 is used to host all public zones.
After an update of the application, the ALB occasionally returns a 502 status code (Bad Gateway) error. The root cause is malformed HTTP headers that are returned to the ALB. The webpage returns successfully when a solutions architect reloads the webpage immediately after the error occurs.
While the company is working on the problem, the solutions architect needs to provide a custom error page instead of the standard ALB error page to visitors.
Which combination of steps will meet this requirement with the LEAST amount of operational overhead?
Create an Amazon S3 bucket. Configure the S3 bucket to host a static webpage. Upload the custom error pages to Amazon S3.
Add a custom error response by configuring a CloudFront custom error page. Modify DNS records to point to a publicly accessible web page.
254
A company has many AWS accounts and uses AWS Organizations to manage all of them. A solutions architect must implement a solution that the company can use to share a common network across multiple accounts.
The company’s infrastructure team has a dedicated infrastructure account that has a VPC. The infrastructure team must use this account to manage the network. Individual accounts cannot have the ability to manage their own networks. However, individual accounts must be able to create AWS resources within subnets.
Which combination of actions should the solutions architect perform to meet these requirements?
Enable resource sharing from the AWS Organizations management account.
Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share.
255
A company wants to use a third-party software-as-a-service (SaaS) application. The third-party SaaS application is consumed through several API calls. The third-party SaaS application also runs on AWS inside a VPC.
The company will consume the third-party SaaS application from inside a VPC. The company has internal security policies that mandate the use of private connectivity that does not traverse the internet. No resources that run in the company VPC are allowed to be accessed from outside the company’s VPC. All permissions must conform to the principles of least privilege.
Which solution meets these requirements?
Create an AWS PrivateLink interface VPC endpoint. Connect this endpoint to the endpoint service that the third-party SaaS application provides. Create a security group to limit the access to the endpoint. Associate the security group with the endpoint.
256
A company needs to implement a patching process for its servers. The on-premises servers and Amazon EC2 instances use a variety of tools to perform patching. Management requires a single report showing the patch status of all the servers and instances.
Which set of actions should a solutions architect take to meet these requirements?
Use AWS Systems Manager to manage patches on the on-premises servers and EC2 instances. Use Systems Manager to generate patch compliance reports.
257
A company is running an application on several Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The load on the application varies throughout the day, and EC2 instances are scaled in and out on a regular basis. Log files from the EC2 instances are copied to a central Amazon S3 bucket every 15 minutes. The security team discovers that log files are missing from some of the terminated EC2 instances.
Which set of actions will ensure that log files are copied to the central S3 bucket from the terminated EC2 instances?
Create an AWS Systems Manager document with a script to copy log files to Amazon S3. Create an Auto Scaling lifecycle hook and an Amazon EventBridge rule to detect lifecycle events from the Auto Scaling group. Invoke an AWS Lambda function on the autoscaling:EC2_INSTANCE_TERMINATING transition to call the AWS Systems Manager API SendCommand operation to run the document to copy the log files and send CONTINUE to the Auto Scaling group to terminate the instance.
258
A company is using multiple AWS accounts. The DNS records are stored in a private hosted zone for Amazon Route 53 in Account A. The company’s applications and databases are running in Account B.
A solutions architect will deploy a two-tier application in a new VPC. To simplify the configuration, the db.example.com CNAME record set for the Amazon RDS endpoint was created in a private hosted zone for Amazon Route 53.
During deployment, the application failed to start. Troubleshooting revealed that db.example.com is not resolvable on the Amazon EC2 instance. The solutions architect confirmed that the record set was created correctly in Route 53.
Which combination of steps should the solutions architect take to resolve this issue?
Create an authorization to associate the private hosted zone in Account A with the new VPC in Account B.
Associate a new VPC in Account B with a hosted zone in Account A. Delete the association authorization in Account A.
259
An application consists of three tiers within a single Region. A Solutions Architect is designing a disaster recovery strategy that includes an RTO of 30 minutes and an RPO of 5 minutes for the data tier. Application tiers use Amazon EC2 instances and are stateless. The data tier consists of a 30TB Amazon Aurora database.
Which combination of steps satisfies the RTO and RPO requirements while optimizing costs?
#ERROR!
260
A new AWS Lambda function has been created to replicate objects that are received in an Amazon S3 bucket to several other S3 buckets in various AWS accounts. The Lambda function is triggered when an object create event occurs in the main S3 bucket. A Solutions Architect is concerned that the function may impact other critical functions due to Lambda's regional concurrency limit.
How can the solutions architect ensure the new Lambda function will not impact other critical Lambda functions?
Configure the reserved concurrency limit for the new Lambda function. Monitor existing critical Lambda functions with Amazon CloudWatch alarms for the Throttles Lambda metric
261
A company wants to run an application on AWS. The company plans to provision its application in Docker containers running in an Amazon ECS cluster. The application requires a MySQL database and the company plans to use Amazon RDS.
What is the MOST cost-effective solution to meet these requirements?
Create an ECS cluster using a fleet of Spot Instances, with Spot Instance draining enabled. Provision the database using Reserved Instances
262
A company has a requirement to store documents that will be accessed by a serverless application. The documents will be accessed frequently for the first 3 months, and rarely after that. The documents must be retained for 7 years.
What is the MOST cost-effective solution to meet these requirements?
Store the documents in a secured Amazon S3 bucket with a lifecycle policy to move the documents that are older than 3 months to Amazon S3 Glacier, then expire the documents from Amazon S3 Glacier that are more than 7 years old
263
A financial services company receives a data feed from a credit card service provider. The feed consists of approximately 2,500 records that are sent every 10 minutes in plaintext and delivered over HTTPS to an encrypted S3 bucket. The data includes credit card data that must be automatically masked before sending the data to another S3 bucket for additional internal processing. There is also a requirement to remove and merge specific fields, and then transform the record into JSON format.
Which solutions will meet these requirements?
Create an AWS Glue crawler and custom classifier based on the data feed formats and build a table definition to match. Trigger an AWS Lambda function on file delivery to start an AWS Glue ETL job to transform the entire record according to the processing and transformation requirements. Define the output format as JSON. Once complete, have the ETL job send the results to another S3 bucket for internal processing
264
A new application that provides fitness and training advice has become extremely popular with thousands of new users from around the world. The web application is hosted on a fleet of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The content consists of static media files and different resources must be loaded depending on the client operating system.
Users have reported increasing latency for loading web pages and Amazon CloudWatch is showing high utilization of the EC2 instances.
Which set actions should a solutions architect take to improve response times?
Move content to Amazon S3. Create an Amazon CloudFront distribution to serve content out of the S3 bucket. Use Lambda@Edge to load different resources based on the User-Agent HTTP header
265
An eCommerce company are running a promotional campaign and expect a large volume of user sign-ups on a web page that collects user information and preferences. The website runs on Amazon EC2 instances and uses an Amazon RDS for PostgreSQL DB instance. The volume of traffic is expected to be high and may be unpredictable with several spikes in activity. The traffic will result in a large number of database writes.
A solutions architect needs to build a solution that does not change the underlying data model and ensures that submissions are not dropped before they are committed to the database.
Which solution meets these requirements?
Create an Amazon SQS queue and decouple the application and database layers. Configure an AWS Lambda function to write items from the queue into the database
266
A company has a mobile application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application is write intensive and costs have recently increased significantly. The biggest increase in cost has been for the AWS Lambda functions. Application utilization is unpredictable but has been increasing steadily each month.
A Solutions Architect has noticed that the Lambda function execution time averages over 4 minutes. This is due to wait time for a high-latency network call to an on-premises MySQL database. A VPN is used to connect to the VPC.
How can the Solutions Architect reduce the cost of the current architecture?
#ERROR!
267
A solution is required for updating user metadata and will be initiated by a fleet of front-end web servers. The solution must be capable of scaling rapidly from hundreds to tens of thousands of jobs in less than a minute. The solution must be asynchronous and minimize costs.
Which solution should a Solutions Architect use to meet these requirements?
Create an AWS Lambda function that will update user metadata. Create an Amazon SQS queue and configure it as an event source for the Lambda function. Update the web application to send jobs to the queue
268
A company has deployed an application that uses an Amazon DynamoDB table and the user base has increased significantly. Users have reported poor response times during busy periods but no error pages have been generated. The application uses Amazon DynamoDB in read-only mode. The operations team has determined that the issue relates to ProvisionedThroughputExceeded exceptions in the application logs when doing Scan and read operations.
A Solutions Architect has been tasked with improving application performance. Which solutions will meet these requirements whilst MINIMIZING changes to the application?
#ERROR!
269
A company has deployed a SAML 2.0 federated identity solution with their on-premises identity provider (IdP) to authenticate users' access to the AWS environment. A Solutions Architect ran authentication tests through the federated identity web portal and access to the AWS environment was granted. When a test users attempt to authenticate through the federated identity web portal, they are not able to access the AWS environment.
Which items should the solutions architect check to ensure identity federation is properly configured?
- The IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal
- The web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML provider, the ARN of the IAM role, and the SAML assertion from IdP
- The company's IdP defines SAML assertions that properly map users or groups in the company to IAM roles with appropriate permissions
270
A global enterprise company is in the process of creating an infrastructure services platform for its users. The company has the following requirements:
* Centrally manage the creation of infrastructure services using a central AWS account.
* Distribute infrastructure services to multiple accounts in AWS Organizations.
* Follow the principle of least privilege to limit end users’ permissions for launching and managing applications.
Which combination of actions using AWS services will meet these requirements?
Define the infrastructure services in AWS CloudFormation templates. Upload each template as an AWS Service Catalog product to portfolios created in a central AWS account. Share these portfolios with the AWS Organizations structure created for the company
Allow IAM users to have AWSServiceCatalogEndUserReadOnlyAccess permissions only. Assign the policy to a group called Endusers, add all users to the group. Apply launch constraints
271
A Solutions Architect is developing a mechanism to gain security approval for Amazon EC2 images (AMIs) so that they can be used by developers. The AMIs must go through an automated assessment process (CVE assessment) and be marked as approved before developers can use them. The approved images must be scanned every 30 days to ensure compliance.
Which combination of steps should the Solutions Architect take to meet these requirements while following best practices?
Use AWS Lambda to write automatic approval rules. Store the approved AMI list in AWS Systems Manager Parameter Store. Use Amazon EventBridge to trigger an AWS Systems Manager Automation document on all EC2 instances every 30 days
Use Amazon Inspector to run the CVE assessment package on the EC2 instances launched from the approved AMIs
272
A company uses AWS Organizations. The company recently acquired a new business unit and invited the new unit’s existing account to the company’s organization. The organization uses a deny list SCP in the root of the organization and all accounts are members of a single OU named Production.
The administrators of the new business unit discovered that they are unable to access AWS Database Migration Service (DMS) to complete an in-progress migration.
Which option will temporarily allow administrators to access AWS DMS and complete the migration project?
Create a temporary OU named Staging for the new account. Apply an SCP to the Staging OU to allow AWS DMS actions. Move the organization's deny list SCP to the Production OU. Move the new account to the Production OU when adjustments to AWS DMS are complete
273
A Solutions Architect is designing a web application that will serve static content in an Amazon S3 bucket and dynamic content hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application will use Amazon CloudFront and the solution should require that the content is available through CloudFront only.
Which combination of steps should the Solutions Architect take to restrict direct content access to CloudFront?
#ERROR!
274
A company includes several business units that each use a separate AWS account and a parent company AWS account. The company requires a single AWS bill across all AWS accounts with costs broken out for each business unit. The company also requires that services and features be restricted in the business unit accounts and this must be governed centrally.
Which combination of steps should a Solutions Architect take to meet these requirements?
#ERROR!
275
A database for an eCommerce website was deployed on an Amazon RDS for MySQL DB instance with General Purpose SSD storage. The database was running performantly for several weeks until a peak shopping period when customers experienced slow performance and timeouts. Amazon CloudWatch metrics indicate that reads and writes to the DB instance were experiencing long response times. Metrics show that CPU utilization is <50%, plenty of available memory, and sufficient free storage space. There is no evidence of database connectivity issues in the application server logs.
What could be the root cause of database performance issues?
A large number of reads and writes exhausted the I/O credit balance due to provisioning low disk storage during the setup phase
276
A company is migrating its on-premises systems to AWS. The computers consist of a combination of Windows and Linux virtual machines on VMware and physical servers.
The company wants to be able to identify dependencies between on-premises systems and group systems together into applications to build migration plans. The company also needs to understand the performance requirements for systems so they can be right-sized.
How can these requirements be met?
Install the AWS Application Discovery Service Discovery Connector in VMware vCenter. Install the AWS Application Discovery Service Discovery Agent on the physical on-premises servers. Allow the Discovery Agent to collect data for a period of time
277
A company is designing an application that will requires cross-Region disaster recovery with an RTO of less than 5 minutes and an RPO of less than 1 minute. The application tier DR solution has already been designed and a Solutions Architect must design the data recovery solution for the MySQL database tier.
How should the database tier be configured to meet the data recovery requirements?
Use an Amazon Aurora global database with the primary in the active Region and the secondary in the failover Region
278
A company runs hundreds of applications across several data centers and office locations. The applications include Windows and Linux operating systems, physical installations as well as virtualized servers, and MySQL and Oracle databases. There is no central configuration management database (CMDB) and existing documentation is incomplete and outdated. A Solutions Architect needs to understand the current environment and estimate the cloud resource costs after the migration.
Which tools or services should the Solutions Architect use to plan the cloud migration
AWS Application Discovery Service
AWS Cloud Adoption Readiness Tool (CART)
AWS Migration Hub
279
A company requires that only the master account in AWS Organizations is able to purchase Amazon EC2 Reserved Instances. Current and future member accounts should be blocked from purchasing Reserved Instances.
Which solution will meet these requirements?
Create an SCP with the Deny effect on the ec2:PurchaseReservedInstancesOffering action. Attach the SCP to the root of the organization
280
A company is using multiple AWS accounts. The company’s DNS records are stored in a private Amazon Route 53 hosted zone in the management account and their applications are running in a production account.
A Solutions Architect is attempting to deploy an application into the production account. The application must resolve a CNAME record set for an Amazon RDS endpoint. The CNAME record set was created in a private hosted zone in the management account.
The deployment failed to start and the Solutions Architect has discovered that the CNAME record is not resolvable on the application EC2 instance despite being correctly created in Route 53.
Which combination of steps should the Solutions Architect take to resolve this issue?
#ERROR!
281
A company runs a data processing application on-premises and plans to move it to the AWS Cloud. Files are uploaded by users to a web application which then stores the files on an NFS-based storage system and places a message on a queue. The files are then processed from the queue and the results are returned to the user (and stored in long-term storage). This process can take up to 30 minutes. The processing times vary significantly and can be much higher during business hours.
What is the MOST cost-effective migration recommendation?
Create a queue using Amazon SQS. Run the web application on Amazon EC2 and configure it to publish to the new queue. Use Amazon EC2 instances in an EC2 Auto Scaling group to pull requests from the queue and process the files. Scale the EC2 instances based on the SQS queue length. Store the processed files in an Amazon S3 bucket
282
A company is testing an application that collects data from sensors fitted to vehicles. The application collects usage statistics data every 4 minutes. The data is sent to Amazon API Gateway, it is then processed by an AWS Lambda function and the results are stored in an Amazon DynamoDB table.
As the sensors have been fitted to more vehicles, and as more metrics have been configured for collection, the Lambda function execution time has increased from a few seconds to over 2 minutes. There are also many TooManyRequestsException errors being generated by Lambda.
Which combination of changes will resolve these issues?
#ERROR!
283
A company is migrating an order processing application to the AWS Cloud. The usage patterns vary significantly but the application must be available at all times. Orders must be processed immediately and in the order that they are received. Which actions should a Solutions Architect take to meet these requirements?
Use Amazon SQS with FIFO to queue messages in the correct order. Use Reserved Instances in multiple Availability Zones for processing
284
A company has created several development accounts in an AWS Organizations organization. The company has defined a fixed budget for each development account and needs to ensure that developers cannot launch expensive services or exceed the fixed monthly budget.
Which combination of steps should a solutions architect take?
Use the AWS Budgets service to define a fixed monthly budget for each development account
Create an SCP that denies access to expensive services. Apply the SCP to an OU containing the development accounts
Create an AWS Budgets alert action to send an Amazon SNS notification when the budgeted amount is reached. Invoke an AWS Lambda function to terminate all services
285
A company is developing an application on AWS, where the application's logs are sent to an Amazon OpenSearch Service cluster within a VPC for analysis. The development team, which includes remote workers and staff at three different office locations, needs to access the OpenSearch Service for log analysis directly from their local development machines.
What is the most effective solution to enable this access while adhering to the requirement that all data must be stored within a VPC?
Set up an AWS Client VPN endpoint, associate it with a subnet in the VPC, and configure a Client VPN self-service portal. Instruct the developers to connect using the Client VPN client
286
A company requires multi-Region availability for an application that runs on Amazon EC2 instances with an Amazon RDS for MySQL database. The solution must offer the highest availability.
Which solution should a solutions architect recommend?
Enable a cross-Region read replica for the RDS database. In the case of an outage, promote the replica to be a standalone DB instance. Point applications to the new DB endpoint and create a read replica to maintain high availability
287
A global enterprise utilizes AWS Control Tower for streamlined account management within its AWS Organizations structure. The enterprise has established a policy across its various organizational units (OUs) to ensure enhanced security and compliance. The policy strictly prohibits Amazon EC2 instances in any of these OUs from being assigned public IP addresses.
What is the most effective solution to enforce this policy across the enterprise's AWS environment while using AWS Control Tower?
Configure Service Control Policies (SCPs) within AWS Control Tower to disallow assigning public IP addresses to EC2 instances across all OUs
288
A company has deployed sensors in its factories to continuously monitor environmental factors such as temperature and lighting. The company seeks an AWS solution to stream this data for real-time analysis and to alert the factory management team immediately if any readings exceed predefined thresholds.
What AWS setup would best achieve this goal?
Stream the environmental data to Amazon Kinesis Data Streams, analyze it using an AWS Lambda function, and configure Amazon SNS to send immediate alerts to the management team if anomalies are detected
289
media company streams live events and records viewership metrics in real-time. The data is ingested through Amazon Kinesis Data Streams and then stored in Amazon S3. The company uses Amazon Athena to analyze viewership trends from the stored data. Initially, the Athena queries performed well, but as the data volume has grown over several months, query performance has degraded.
The solutions architect needs to optimize the query performance while keeping operational overhead low.
Which solution will effectively address the performance issue?
Configure the Kinesis Data Firehose delivery stream to partition the data in Amazon S3 by date and event type. Redefine the Athena table to include these partitions and modify the queries to specifically target relevant partitions
290
A company has deployed an eCommerce application that is used by thousands of customers to place online orders. The application runs on Amazon ECS tasks behind an Application Load Balancer (ALB) and data is stored in an Amazon DynamoDB table.
The application has recently experienced attacks that caused application slowdowns and outages. The company must prevent attacks and ensure business continuity with minimal service interruptions.
Which combination of steps will meet these requirements MOST cost-effectively?
Create an Amazon CloudFront distribution with the ALB as the origin and configure a custom header and secret value. Configure the ALB to conditionally forward traffic only if the header and value match
Deploy an AWS WAF web ACL that includes a rule group that blocks the attack traffic. Associate the web ACL with the Amazon CloudFront distribution
291
A company is testing an application that collects data from sensors fitted to vehicles. The application collects usage statistics data every 4 minutes. The data is sent to Amazon API Gateway, it is then processed by an AWS Lambda function and the results are stored in an Amazon DynamoDB table.
As the sensors have been fitted to more vehicles, and as more metrics have been configured for collection, the Lambda function execution time has increased from a few seconds to over 2 minutes. There are also many TooManyRequestsException errors being generated by Lambda.
Which combination of changes will resolve these issues?
Increase the memory available to the Lambda functions
Stream the data into an Amazon Kinesis data stream from API Gateway and process the data in batches
292
company has established a 10 Gbps AWS Direct Connect (DX) connection to a single VPC in an AWS Region. A single private VIF has been created for the existing DX connection. The company requires redundancy for the existing DX connection and needs to connect to an additional VPC in a second Region.
What solution meets these requirements?
Create a new DX connection to the same Region. Provision a Direct Connect gateway and establish new private VIFs to a virtual private gateway in the VPCs in each Region
293
A company is building a web application hosted on Amazon EC2 instances within an Auto Scaling group, fronted by a public-facing Application Load Balancer (ALB). The application should be accessible only to users from a designated country, and the company wants to log any access attempts that are blocked. The desired solution should be low maintenance.
What approach should be taken to meet these requirements?
Create an AWS WAF web ACL with a geo-match rule to block requests from outside the specified country. Associate this rule with the web ACL, and then attach the web ACL to the ALB
294
An application stores user comment data in multiple Amazon DynamoDB tables. A solutions architect must use a serverless architecture to make the data accessible publicly through a simple and cost-effective API over HTTPS. The solution must scale automatically in response to demand.
Which solutions meet these requirements?
Create an Amazon API Gateway HTTP API. Configure this API with direct integrations to DynamoDB by using API Gateway's AWS Service integration type
295
A company wants to run an application on AWS. The company plans to provision its application in Docker containers running in an Amazon ECS cluster. The application requires a MySQL database and the company plans to use Amazon RDS.
What is the MOST cost-effective solution to meet these requirements?
Create an ECS cluster using a fleet of Spot Instances, with Spot Instance draining enabled. Provision the database using Reserved Instances
296
A company is designing an application that will requires cross-Region disaster recovery with an RTO of less than 5 minutes and an RPO of less than 1 minute. The application tier DR solution has already been designed and a Solutions Architect must design the data recovery solution for the MySQL database tier.
How should the database tier be configured to meet the data recovery requirements?
Use an Amazon Aurora global database with the primary in the active Region and the secondary in the failover Region
297
What is Apache ActiveMQ?
Apache ActiveMQ® is the most popular open source, multi-protocol, Java-based message broker.
298
A company runs applications on Microsoft Windows servers in an on-premises data center. The servers access a file system shared from one of the Windows servers. Several gigabytes of new data are produced daily. The company is migrating to the cloud and requires the data to be accessible on a file system in the AWS cloud.
Which data migration strategy should the company use?
Use AWS DataSync to schedule a daily task that replicates data between the on-premises file share and Amazon FSX
299
A developer is attempting to access an Amazon S3 bucket in a member account in AWS Organizations. The developer is logged in to the account with user credentials and has received an access denied error with no bucket listed. The developer should have read-only access to all buckets in the account.
A Solutions Architect has reviewed the permissions and found that the developer's IAM user has been granted read-only access to all S3 buckets in the account.
Which additional steps should the Solutions Architect take to troubleshoot the issue?
#ERROR!
300
A financial services company is implementing AWS Lambda functions to connect to an Amazon Aurora MySQL database cluster. These Lambda functions will be utilized in both a development environment for testing and a live production environment.
The company's priority is to ensure that database credentials are not hardcoded within the Lambda functions and that there's a system in place for the automated rotation of passwords.
Which solution will fulfill these requirements?
Configure AWS Secrets Manager for managing the database credentials, creating separate secret keys for the development and production environments. Enable automatic secret rotation. Pass the Secrets Manager secret ARNs to the Lambda functions through environment variables. Assign appropriate IAM roles to the Lambda functions for accessing the secrets
301
A company utilizing Amazon Connect for their contact center is encountering a surge in automated calls, affecting both operational costs and agent productivity. They need a system where agents can easily mark a call as spam, subsequently preventing such numbers from being routed to agents in the future.
What is the most effective and operationally efficient solution for this scenario?
Add a custom 'flag as spam' button to the Contact Control Panel (CCP) in Amazon Connect. This button triggers an AWS Lambda function to update call attributes and log the number in an Amazon DynamoDB table. Adapt the contact flows to reference these attributes and interact with the DynamoDB table for future call filtering
302
A company plans to build a gaming application in the AWS Cloud that will be used by Internet-based users. The application will run on a single instance and connections from users will be made over the UDP protocol. The company has requested that the service is implemented with a high level of security. A Solutions Architect has been asked to design a solution for the application on AWS.
Which combination of steps should the Solutions Architect take to meet these requirements?
- Use a Network Load Balancer (NLB) in front of the application instance. Use a friendly DNS entry in Amazon Route 53 pointing to the NLB's Elastic IP address
- Configure a network ACL rule to block all non-UDP traffic. Associate the network ACL with the subnets that hold the load balancer instances
- Enable AWS Shield Advanced on all public-facing resources
303
A company has created a service that they would like a customer to access. The service runs in the company’s AWS account and the customer has a separate AWS account. The company would like to enable the customer to establish least privilege security access using an API or command line tool to the customer account.
What is the MOST secure way to enable the customer to access the service?
The company should create an IAM role and assign the required permissions to the IAM role. The customer should then use the IAM role's Amazon Resource Name (ARN), including the external ID in the IAM role's trust policy, when requesting access to perform the required tasks
304
A Solutions Architect needs to design the architecture for an application that requires high availability within and across AWS Regions. The design must support failover to the second Region within 1 minute and must minimize the impact on the user experience. The application will include three tiers, the web tier, application tier and NoSQL data tier.
Which combination of steps will meet these requirements?
- Use an Amazon Route 53 failover routing policy for failover from the primary Region to the disaster recovery Region. Set Time to Live (TTL) to 30 seconds
- Use Amazon DynamoDB with a global table across both Regions so reads and writes can occur in either location
- Run the web and application tiers in both Regions in an active/passive configuration. Use Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use zonal Reserved Instances for the minimum number of servers and On-Demand Instances for any additional resources
305
A company is using AWS CloudFormation templates for infrastructure provisioning. The templates are hosted in the company’s private GitHub repository. The company has experienced several issues with updates to the templates that have caused errors when executing the updates and creating the environment. A Solutions Architect must resolve these issues and implement automated testing of the CloudFormation template updates.
How can the Solutions Architect accomplish these requirements?
Use AWS CodePipeline to a create a change set when updates are made to the CloudFormation templates in GitHub. Include a CodePipeline action to test the deployment with testing scripts run using AWS CodeBuild. Upon successful testing, configure CodePipeline to execute the change set and deploy to production
306
A company recently noticed an increase in costs associated with Amazon EC2 instances and Amazon RDS databases. The company needs to be able to track the costs. The company uses AWS Organizations for all of their accounts. AWS CloudFormation is used for deploying infrastructure and all resources are tagged. The management team has requested that cost center numbers and project ID numbers are added to all future EC2 instances and RDS databases.
What is the MOST efficient strategy a Solutions Architect should follow to meet these requirements?
Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID. Use SCPs to restrict the creation of resources that do not have the cost center and project ID tags specified
307
A company is running a custom Java application on-premises and plans to migrate the application to the AWS Cloud. The application uses a MySQL database and the application servers maintain users’ sessions locally. Which combination of architecture changes will be required to create a highly available solution on AWS?
- Configure the application to store the user's session in Amazon ElastiCache. Use Application Load Balancers to distribute the load between application instances
- Migrate the database to Amazon RDS for MySQL. Configure the RDS instance to use a Multi-AZ deployment
- Put the application instances in an Amazon EC2 Auto Scaling group. Configure the Auto Scaling group to create new instances if an instance becomes unhealthy
308
A company uses Amazon RedShift for analytics. Several teams deploy and manage their own RedShift clusters and management has requested that the costs for these clusters is better managed. The management team has set budgets and once the budgetary thresholds have been reached a notification should be sent to a distribution list for managers. Teams should be able to view their RedShift cluster’s expenses to date. A Solutions Architect needs to create a solution that ensures the policy is centrally enforced in a multi-account environment.
Which combination of steps should the solutions architect take to meet these requirements?
- Update the AWS CloudFormation template to include the AWS::Budgets::Budget::resource with the NotificationsWithSubscribers property
- Create an AWS Service Catalog portfolio for each team. Add each team's Amazon RedShift cluster as an AWS CloudFormation template to their Service Catalog portfolio as a Product
309
A Solutions Architect has deployed an application on Amazon EC2 instances in a private subnet behind a Network Load Balancer (NLB) in a public subnet. Customers have attempted to connect from their office location and are unable to access the application. The targets were registered by instance-id and are all healthy in the associated target group.
What step should the Solutions Architect take to resolve the issue and enable access for the customers?
Check the security group for the EC2 instances to ensure it allows ingress from the customer office
310
A company has an NFS file server on-premises with 50 TB of data that is being migrated to Amazon S3. The data is made up of many millions of small and files and a Snowball Edge device is being used for the migration. A shell script is being used to copy data using the file interface of the Snowball Edge device. Data transfer times are very slow and the Solutions Architect suspects this may be related to the overhead of encrypting all the small files and copying them over the network.
What change should be made to improve data transfer times?
Perform multiple copy operations at one time by running each command from a separate terminal window, in separate instances of the Snowball client
311
A company is deploying a web service that will provide read and write access to structured data. The company expects there to be variable usage patterns with some short but significant spikes. The service must dynamically scale and must be fault tolerant across multiple AWS Regions.
Which actions should a Solutions Architect take to meet these requirements?
Store the data in an Amazon DynamoDB global table in two Regions using on-demand capacity mode. Run the web service in both Regions as Amazon ECS Fargate tasks in an Auto Scaling ECS service behind an Application Load Balancer (ALB). In Amazon Route 53, configure an alias record and a latency-based routing policy with health checks to distribute traffic between the two ALBs
312
An application runs on an Amazon EC2 instance with an attached Amazon EBS Provisioned IOPS (PIOPS) volume. The volume is configured at 200-GB in size and has 3,000 IOPS provisioned. The application requires low latency and random access to the data. A Solutions Architect has been asked to consider options for lowering the cost of the storage without impacting performance and durability.
What should the Solutions Architect recommend?
Change the PIOPS volume for a 1-TB EBS General Purpose SSD (gp2) volume
313
A solutions architect developed a web application that includes an AWS Lambda function that queries an Amazon Aurora MySQL database. The database is configured with three read replicas. During periods of high demand, the application does not meet performance requirements. A solutions architect noticed that the application opens many database connections, and this causes latency in the application
Which actions should the solutions architect take to improve the performance?
#ERROR!
314
A company runs an application that generates user activity reports and stores them in an Amazon S3 bucket. Users are able to download the reports using the application which generates a signed URL. A user recently reported that the reports of other users can be accessed directly from the S3 bucket. A Solutions Architect reviewed the bucket permissions and discovered that public access is currently enabled.
How can the documents be protected from unauthorized access without modifying the application workflow?
Use the Block Public Access feature in Amazon S3 to set the IgnorePublicAcls option to TRUE on the bucket
315
A company is planning to migrate an application from an on-premises data center to the AWS Cloud. The application consists of a stateful servers and a separate MySQL database. The application is expected to receive significant traffic and must scale seamlessly. The solution design on AWS includes an Amazon Aurora MySQL database, Amazon EC2 Auto Scaling and Elastic Load Balancing.
A Solutions Architect needs to finalize the design for the solution. Which configurations will ensure a consistent user experience and seamless scalability for both the application and database tiers?
#ERROR!
316
A company uses multiple AWS accounts. There are separate accounts for development, staging, and production environments. Some new requirements have been issued to control costs and improve the overall governance of the AWS accounts. The company must be able to calculate costs associated with each project and each environment. Commonly deployed IT services must be centrally managed and business units should be restricted to deploying pre-approved IT services only.
Which combination of actions should be taken to meet these requirements?
#ERROR!
317
A serverless application is using AWS Lambda and Amazon DynamoDB and developers have finalized an update to the Lambda function code. AWS CodeDeploy will be used to deploy new versions of the function. Updates to the Lambda function should be delivered to a subset of users before deploying the changes to all users. The update process should also be easy to abort and rollback if necessary.
Which CodeDeploy configuration should the solutions architect use?
A canary deployment
318
A company operates a mobile application that enables users to upload images for processing. The app experiences a surge in usage, with thousands of uploads per minute, primarily between 8 AM and 5 PM on weekdays, and minimal activity at other times. Users receive notifications when their image processing is complete.
To effectively manage this variable load and ensure scalable image processing, which three steps should a solutions architect implement?
#ERROR!
319
A company has deployed a new application into an Amazon VPC that does not have Internet access. The company has connected an AWS Direct Connection (DX) private VIF to the VPC and all communications will be over the DX connection. A new requirement states that all data in transit must be encrypted between users and the VPC.
Which strategy should a Solutions Architect use to maintain consistent network performance while meeting this new requirement?
Create a new public virtual interface for the existing DX connection, and create a new VPN that connects to the VPC over the DX public virtual interface
320
A company operates a large-scale workload with numerous Amazon EC2 instances within a VPC, which includes both public and private subnets. The public subnets are currently configured with a route to an internet gateway for IPv4 traffic (0.0.0.0/0), while the private subnets route IPv4 traffic (0.0.0.0/0) to a NAT gateway. The company now plans to transition its EC2 instances to IPv6, ensuring that instances in private subnets remain inaccessible from the public internet.
To achieve this IPv6 migration while adhering to the specified network accessibility requirements, what actions should the solutions architect take?
Modify the existing VPC to include an Amazon-provided IPv6 CIDR block for the VPC and its subnets. For the public subnets, update the route tables to route IPv6 traffic (::/0) to the internet gateway. For the private subnets, update the route tables to route IPv6 traffic (::/0) to an egress-only internet gateway
321
A company is moving their IT infrastructure to the AWS Cloud and will have several Amazon VPCs within an AWS Region. The company requires centralized and controlled egress-only internet access. The solution must be highly available and horizontally scalable. The company is expecting to grow the number of VPCs to more than fifty.
A Solutions Architect is designing the network for the new cloud deployment. Which design pattern will meet the stated requirements?
Attach each VPC to a shared transit gateway. Use an egress VPC with firewall appliances in two AZs and connect the transit gateway using IPSec VPNs with BGP
322
A company is updating their operating system patching processes. The company manages both on-premises servers and Amazon EC2 instances using multiple toolsets. A solutions architect wants to utilize a single tool for all servers and instances that can deploy patches and report on patch status.
Which set of actions should the solutions architect take to meet these requirements?
Use AWS Systems Manager Patch Manager to deploy patches on the on-premises servers and EC2 instances. Use Systems Manager to generate patch compliance reports
323
A company has hundreds of accounts in AWS Organizations. There are several OUs for development teams that each contain multiple accounts. A manager requires that a report showing usage costs is generated for each development OU that shows all costs accrued by accounts within the OU.
Which solution meets these requirements?
Create an AWS Cost and Usage Report (CUR) from the AWS Organizations management account. Allow each team to visualize the CUR through an Amazon QuickSight dashboard
324
A company currently manages a fleet of Amazon EC2 instances running Windows and Linux in public and private subnets. The operations team currently connects over the Internet to manage the instances as there is no connection to the corporate network.
Security groups have been updated to allow the RDP and SSH protocols from any source IPv4 address. There have been reports of malicious attempts to access the resources as the company wishes to implement the most secure solution for managing the instances.
Which strategy should a Solutions Architect recommend?
Deploy the AWS Systems Manager Agent on the EC2 instances. Access the EC2 instances using Session Manager restricting access to users with permission to manage the instances
325
A company has deployed an application on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB). The ALB is configured as the origin in an Amazon CloudFront distribution. The company requires that the solution is secured against web-based attacks. An AWS WAF web ACL has been created and associated with the CloudFront distribution. The company must prevent anyone from circumventing the CloudFront distribution and connecting directly to the ALB.
Which solution will meet these requirements with the LEAST operational overhead?
Add a security group rule to the ALB to allow traffic from the AWS managed prefix list for CloudFront only
326
A healthcare company with several AWS accounts is looking to enhance its data security posture. A recent internal review highlighted numerous Amazon S3 buckets containing sensitive patient data that are not encrypted. The company needs a systematic approach to encrypt these existing S3 buckets and ensure future compliance across all AWS accounts.
The company also seeks a centralized management solution for its AWS accounts with a focus on security and regulatory compliance.
Which two actions should the solutions architect take to address these requirements?
#ERROR!
327
A Solutions Architect is migrating an application to AWS Fargate. The task runs in a private subnet and does not have direct connectivity to the internet. When the Fargate task is launched, it fails with the following error:
CannotPullContainerError: API error (500): Get https://111122223333.dkr.ecr.us-east-1.amazonaws.com/v2/: net/http: request canceled while waiting for connection"
What should the Solutions Architect do to correct the error?
Specify DISABLED for Auto-assign public IP when launching the task and configure a NAT gateway in a public subnet to route requests to the internet
328
A company provides a service that allows users to upload high-resolution product images using an app on their phones for a price matching service. The service currently uses Amazon S3 in the us-west-1 Region. The company has expanded to Europe and users in European countries are experiencing significant delays when uploading images.
Which combination of changes can a Solutions Architect make to improve the upload times for the images?
#ERROR!
329
A company has a large photo library stored on Amazon S3. They use AWS Lambda to extract metadata from the files according to various processing rules for different categories of photo. The output is then stored in an Amazon DynamoDB table.
The extraction process is performed whenever customer requests are submitted and can take up to 60 minutes to complete. The company wants to reduce the time taken to extract the metadata and has split the single Lambda function into separate Lambda functions for each category of photo.
Which additional steps should the Solutions Architect take to meet the requirements?
Create an AWS Step Functions workflow to run the Lambda functions in parallel. Create a Lambda function to retrieve a list of files and write each item to an Amazon SQS queue. Configure a Lambda function to retrieve messages from the SQS queue and call the StartExecution API
330
A Solution Architect used the AWS Application Discovery Service to gather information about some on-premises database servers. The tool discovered an Oracle data warehouse and several MySQL databases. The company plans to migrate to AWS and the Solutions Architect must determine the best migration pattern for each database.
Which combination of migration patterns will reduce licensing costs and operational overhead?
#ERROR!
331
A company has deployed two Microsoft Active Directory Domain Controllers into an Amazon VPC with a default configuration. The DHCP options set associated with the VPC has been configured to assign the IP addresses of the Domain Controllers as DNS servers. A VPC interface endpoint has been created but EC2 instances within the VPC are unable to resolve the private endpoint addresses.
Which strategies could a Solutions Architect use to resolve the issue?
- Update the DNS service on the Active Directory servers to forward all non-authoritative queries to the VPC Resolver
- Define an outbound Amazon Route 53 Resolver. Set a conditional forwarding rule for the Active Directory domain to the Active Directory servers. Configure the DNS settings in the VPC DHCP options set to use the AmazonProvidedDNS servers
332
A company runs an application in an on-premises data center that uses an IBM Db2 database. The web application calls an API that runs stored procedures on the database to retrieve read-only data. The dataset is constantly updated. Users have reported significant latency when attempting to retrieve data. The company are concerned about Db2 CPU licensing costs and the performance of the database.
Which approach should a Solutions Architect take to migrate to AWS and resolve these concerns?
Use AWS DMS to migrate data to Amazon DynamoDB using a continuous replication task. Refactor the API to use the DynamoDB data. Implement the refactored API in Amazon API Gateway and enable API caching
333
A corporation needs to quickly enable 350 staff members to work remotely in the event of an emergency. Their current setup includes a mix of Windows and Linux desktops with various applications installed, such as office suites and communication tools.
The solution must integrate with the company's existing on-premises Active Directory, allowing staff to use their current login credentials. Additionally, it should support multifactor authentication (MFA) and closely replicate the user interface of their existing desktop environments.
Which AWS solution would best meet these criteria?
Use Amazon WorkSpaces for providing cloud desktops. Connect it to the on-premises network via VPN, integrate with the on-premises Active Directory using an AD Connector, and set up a RADIUS server to enable MFA
334
A company has deployed a web application in an Amazon VPC. A CloudFront distribution is used for both scalability and performance. The operations team has noticed that the cache hit ratio has been dropping over time leading to a gradual degradation of the performance for the web application.
The cache metrics report indicates that query strings on some URLs are inconsistently ordered and are specified in a mixture of mixed-case letters.
Which actions can a Solutions Architect take to increase the cache hit ratio and resolve the performance issues on the web application?
Create a Lambda@Edge function to sort parameters by name and force them to be lowercase. Select the CloudFront viewer request trigger to invoke the function
335
A data hosting company has developed a new application which works on a custom TCP port. The service must use fixed address assignments so other companies can whitelist the addresses in their firewalls. The application will be hosted on the publicly accessible DNS domain name cloud.myservice.com. The solution must offer high availability and redundancy across Availability Zones in a single AWS Region.
Which solution will meet these requirements?
Create Amazon EC2 instances for the service. Create one Elastic IP address for each Availability Zone. Create a Network Load Balancer (NLB) and expose the assigned TCP port. Assign the Elastic IP addresses to the NLB for each Availability Zone. Create a target group and register the EC2 instances with the NLB. Create a new A (alias) record set named cloud.myservice.com and assign the NLB DNS name to the record set
336
company requires federated access to AWS for users of a mobile application. The security team has mandated that the application must use a custom-built solution for authenticating users and use IAM roles for authorization.
Which actions would enable authentication and authorization and satisfy the requirements?
#ERROR!
337
An advertising company hosts static content in an Amazon S3 bucket that is served by Amazon CloudFront. The static content is generated programmatically from a Development account, and the S3 bucket and CloudFront are in a Production account. The build pipeline uploads the files to Amazon S3 using an IAM role in the Development Account. The S3 bucket has a bucket policy that only allows CloudFront to read objects using an origin access identity (OAI). During testing all attempts to upload objects using the to the S3 bucket are denied..
How can a Solutions Architect resolve this issue and allow the objects to be uploaded to Amazon S3?
Create a new cross-account IAM role in the Production account with write access to the S3 bucket. Modify the build pipeline to assume this role to upload the files to the Production Account
338
A retail company is transitioning its sales data processing system to AWS. The system must handle fluctuating sales data inputs, especially during seasonal peaks. The data processing involves receiving sales transactions, processing them for analytics, and storing the results in an Amazon RDS instance. The system should be able to handle variable loads without manual intervention for scaling.
Which architecture would BEST meet these requirements?
Implement an Amazon Kinesis Data Firehose for ingesting sales transactions and process them using AWS Lambda functions before storing in an Amazon RDS instance
339
An application uses Amazon EC2 instances in an Auto Scaling group and an Amazon RDS MySQL database. The web application has occasional spikes of traffic during the day. The operations team have determined the most appropriate instances sizes for both the EC2 instances and the DB instance. All instances use On-Demand pricing.
What steps can be taken to gain the most cost savings without impacting the reliability of the application?
Reserve capacity for the RDS database and the minimum number of EC2 instances that are constantly running
340
A growing e-commerce company uses a legacy CRM system hosted in an on-premises server. The sales team frequently accesses this system for customer data, leading to high server load during peak hours. The company wants to leverage AWS to improve system availability, enhance data processing speed, and manage increasing data volumes with minimal operational overhead.
Which combination of steps will meet these requirements with the LEAST operational overhead?
- Implement Amazon RDS to host the CRM's database
- Migrate the CRM system to Amazon EC2 instances
341
A Solutions Architect is working on refactoring a monolithic application into a modern application design that will be deployed in the AWS Cloud. A CI/CD pipeline should be used that supports the modern design and allows for multiple releases every hour. The pipeline should also ensure that changes can be quickly rolled back if required.
Which design will meet these requirements?
Use AWS Elastic Beanstalk and create a secondary environment configured as a deployment target for the CI/CD pipeline. To deploy, swap the staging and production environment URLs
342
A fintech company runs an on-premises environment that ingests data feeds from financial services companies, transforms the data, and then sends it to an on-premises Apache Kafka cluster. The company plans to use AWS services to build a scalable, near real-time solution that offers consistent network performance to provide the data feeds to a web application. Which steps should a Solutions Architect take to build the solution?
#ERROR!
343
A company plans to migrate a content management system (CMS) to AWS. The CMS will use Amazon CloudFront to ensure optimum performance for users from around the world. The CMS includes both static and dynamic content and has been placed behind an Application Load Balancer (ALB) which is the default origin for the CloudFront distribution. The static assets are served from an Amazon S3 bucket.
When users attempt to access the static assets HTTP status code 404 errors are generated. Which actions should a Solutions Architect take to resolve the issue?
#ERROR!
344
A financial services company runs an application that allows traders to perform online simulations of market conditions. The backend runs on a fleet of virtual machines in an on-premises data center and the business logic is exposed using a REST API with multiple functions. The trader’s session data is stored in a NAS file system in the on-premises data center. During busy periods of the day the server capacity is insufficient and latency issues have occurred when fetching the session data for a simulation.
A Solutions Architect must create a design for moving the application to AWS. The design must use the same API model but should be capable of scaling for the variable load and ensure access to session data is provided with low-latency.
Which solutions meets these requirements?
Implement the REST API using Amazon API Gateway. Run the business logic in AWS Lambda. Store trader session data in Amazon DynamoDB with on-demand capacity
345
A Solutions Architect has been asked to implement a disaster recovery (DR) site for an eCommerce platform that is growing at an increasing rate. The platform runs on Amazon EC2 web servers behind Elastic Load Balancers, images stored in Amazon S3 and Amazon DynamoDB tables that store product and customer data. The DR site should be located in a separate AWS Region.
Which combinations of actions should the Solutions Architect take to implement the DR site?
- Enable Amazon Route 53 health checks to determine if the primary site is down, and route traffic to the disaster recovery site if there is an issue
- Enable Amazon S3 cross-Region replication on the buckets that contain images
- Enable DynamoDB global tables to achieve multi-Region table replication
346
A financial company processes transactions using on-premises application servers which save output to an Amazon DynamoDB table. The company’s data center is connected to AWS using an AWS Direct Connect (DX) connection. Company managed has mandated that the solution should be available across multiple Regions. Consistent network performance must be maintained at all times.
What changes should the company make to meet these requirements?
Create a DX connection to a second AWS Region. Use DynamoDB global tables to replicate data to the second Region. Modify the application to fail over to the second Region
347
A financial services company is looking to enhance its web application deployment process to ensure rapid and safe updates. The application, which handles sensitive financial transactions, is hosted on a cluster of Amazon EC2 instances behind an Application Load Balancer (ALB). The source code is maintained in a Bitbucket repository, and they use AWS CodeBuild for building the application. The company plans to integrate AWS CodePipeline for automating the deployment process from Bitbucket commits.
The key requirements are to minimize downtime during updates and provide a mechanism for quick rollback in case the new version introduces bugs or security vulnerabilities.
Which CI/CD setup would best fulfill these requirements?
Configure CodePipeline with a deployment stage using AWS CodeDeploy for blue/green deployments. After deploying the new version, monitor its performance and security, and use CodeDeploy's rollback feature in case of any issues"
348
A Solutions Architect is helping to standardize a company’s method of deploying applications to AWS using AWS CodePipeline and AWS CloudFormation. A group of developers create applications using JavaScript and TypeScript and they are concerned about needing to learn new domain-specific languages. They are also reluctant to lose access to features of the existing languages such as looping.
How can the Solutions Architect address the developers concerns and quickly bring the applications up to deployment standards?
Define the AWS resources using JavaScript or TypeScript. Use the AWS Cloud Development Kit (AWS CDK) to create CloudFormation templates from the developers' code and use the AWS CDK to create CloudFormation stacks. Incorporate the AWS CDK as a CodeBuild job in CodePipeline
349
An agricultural company is rolling out thousands of devices that will send environmental data to a data platform. The platform will process and analyze the data and provide information back to researchers. The devices will send 8 KB of data every second and the solution must support near real-time analytics, provide durability for the data, and deliver results to a data warehouse.
Which strategy should a solutions architect use to meet these requirements?
Use Amazon Kinesis Data Streams to collect the inbound data, analyze the data with Kinesis clients, and save the results to an Amazon Redshift cluster using Amazon EMR
350
A university is running computational algorithms that require large amounts of compute power. The algorithms are being run using a high-performance compute cluster on Amazon EC2 Spot instances. Each time an instance launches a DNS record must be created in an Amazon Route 53 private hosted zone. When the instance is terminated the DNS record must be deleted.
The current configuration uses an Amazon CloudWatch Events rule that triggers an AWS Lambda function to create the DNS record. When scaling the solution to thousands of instances the university has experienced “HTTP 400 error (Bad request)†errors in the Lambda logs. The response header also includes a status code element with a value of "Throttling" and a status message element with a value of "Rate exceeded".
Which combination of steps should the Solutions Architect take to resolve these issues?
- Update the CloudWatch Events rule to trigger on Amazon EC2 "Instance Launch Successful" and "Instance Terminate Successful" events for the Auto Scaling group used by the cluster
- Configure a Lambda function to retrieve messages from an Amazon SQS queue. Modify the Lambda function to retrieve a maximum of 10 messages then batch the messages by Amazon Route 53 API call type and submit. Delete the messages from the SQS queue after successful API calls
351
A company has experienced issues updating an AWS Lambda function that is deployed using an AWS CloudFormation stack. The issues have resulted in outages that affected large numbers of customers. A Solutions Architect must adjust the deployment process to support a canary release strategy. Invocation traffic should be routed based on specified weights.
Which solution will meet these requirements?
Create an alias for new versions of the Lambda function. Use the AWS CLI update-alias command with the routing-config parameter to distribute the load
352
A pharmaceutical company has deployed an application on their private Amazon VPC. They need to use a third-party software-as-a-service (SaaS) application which is hosted in another AWS account inside an Amazon VPC.
They need to connect applications to the third-party SaaS from private subnets in the company VPC. The company’s security team has mandated policies that private network needs to be used without internet propagation. No resources that run in the company VPC are allowed to be accessed from outside the company's VPC. All permissions must conform to the principles of least privilege.
Which solution meets these requirements?
Create an AWS PrivateLink interface VPC endpoint. Connect this endpoint to the endpoint service that the third-party SaaS application provides. Create a security group to limit the access to the endpoint. Associate the security group with the endpoint
353
A company runs a traffic sensor related IoT platform on AWS. Applications are hosted on EC2 instances and receive sensor data containing traffic information in real time. Applications are written in Node.js and have an Application Load Balancer in front. The backend includes an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume.
The company want to deploy the application to a much larger number of sensors. During initial testing the API servers were consistently overloaded and RDS metrics showed high write latency.
Which steps together will resolve the issues permanently and enable growth as new sensors are provisioned, while keeping this platform cost-efficient?
Leverage Amazon Kinesis Data Streams and AWS Lambda to ingest and process the raw data
354
A security team uses a ticketing system to capture suspicious events that require investigation. The security team has created a system where events are captured using CloudTrail Logs and saved to Amazon S3. A scheduled AWS Lambda function then uses Amazon Athena to query the logs for any API actions performed by the root user. The results are then submitted to the ticketing system by the Lambda function.
The ticketing system has a monthly 4-hour maintenance window when the system is offline and cannot log new tickets and an audit revealed that several tickets were not created due to the ticketing system being unavailable.
Which combination of steps should a solutions architect take to ensure that the incidents are reported to the ticketing system even during planned maintenance?
#ERROR!
355
A company offers a photo sharing application to its users through a social networking app. To ensure images can be displayed with consistency, a single Amazon EC2 instance running JavaScript code processes the photos and stores the processed images in an Amazon S3 bucket. A front-end application runs from a static website in another S3 bucket and loads the processed images for display in the app.
The company has asked a Solutions Architect to make some recommendations for a cost-effective solution that offers massive scalability for a global user base.
Which combination of changes should the Solutions Architect recommend?
#ERROR!
356
A company is planning to migrate on-premises resources to AWS. The resources include over 150 virtual machines (VMs) that use around 50 TB of storage. Most VMs can be taken offline outside of business hours, however, a few are mission critical and downtime must be minimized. The company’s internet bandwidth is fully utilized and cannot currently be increased. A Solutions Architect must design a migration strategy that can be completed within the next 3 months.
Which method would fulfill these requirements?
- Set up a 1 Gbps AWS Direct Connect connection. Then, provision a private virtual interface, and use AWS Application Migration Service (MGN) to migrate the VMs into Amazon EC2
357
A healthcare company's AWS-hosted SaaS application includes an HTTPS endpoint served by Amazon API Gateway and uses AWS Lambda for processing, with data stored in an Amazon Aurora Serverless v1 database. The application, deployed using AWS Serverless Application Model (AWS SAM), operates across several Availability Zones but lacks a comprehensive disaster recovery (DR) strategy. The company seeks a DR plan capable of restoring services in an alternate AWS Region, targeting a recovery time objective (RTO) of 10 minutes and a recovery point objective (RPO) of 2 minutes.
What measures should the solutions architect implement to fulfill these DR requirements?
Convert the Aurora Serverless v1 database to a multi-Region Aurora MySQL database, ensuring continuous data replication across the primary and a secondary Region. Use AWS SAM to script the application deployment in the secondary Region for rapid recovery
358
An eCommerce company runs a successful website with a growing base of customers. The website is becoming popular internationally and demand is increasing quickly. The website is currently hosted in an on-premises data center with web servers and a MySQL database. The company plans to migrate the workloads to AWS. A Solutions Architect has been asked to create a solution that:
- Improves security
- Improves reliability
- Improves availability
- Reduces latency
- Reduces maintenance
Which combination of steps should the Solutions Architect take to meet these requirements?
#ERROR!
359
A media advertising company currently has resources hosted in two AWS accounts: Management and Production. DNS records are stored in a private hosted zone using Amazon Route 53 in the Management account. The Production account is used for applications and databases.
The company has deployed a two-tier application in a new VPC. To simplify the configuration, the database.company.com CNAME record set for the Amazon RDS endpoint was created in a private hosted zone for Amazon Route 53.
While deploying, the application failed to start. Troubleshooting revealed that database.company.com is not resolvable within the Amazon EC2 instance. The solutions architect confirmed that the record set was created correctly in Route 53.
Which combination of steps should the solutions architect take to resolve this issue?
#ERROR!
360
A company runs Docker containers on Amazon ECS. A containerized application uses a custom tool that must be manually updated each time the container code is updated. The updated container image can then be used for new tasks. A Solutions Architect has been tasked with automating this process to eliminate the manual work and ensure a new container image is generated each time the tool code is updated.
Which combination of actions should the Solutions Architect take to meet these requirements?
#ERROR!
361
A new application will ingest millions of records per minute from user devices all over the world. Each record is less than 4 KB in size and must be stored durably and accessed with low latency. The data must be stored for 90 days after which it can be deleted. It has been estimated that storage requirements for a year will be 15-20TB.
Which storage strategy is the MOST cost-effective and meets the design requirements?
Store each incoming record in an Amazon DynamoDB table. Configure the DynamoDB Time to Live (TTL) feature to delete records older than 90 days
362
A company is in the process of migrating applications to AWS using multiple accounts in AWS Organizations . The management account is at the root of the Organizations hierarchy. Business units each have different accounts and requirements for the services they need to use. The security team needs to implement controls across all accounts to prohibit many AWS services. In some cases a business unit may have a valid exception to these controls and this must be achievable.
Which solution will meet these requirements with minimal optional overhead?
Use an SCP in Organizations to implement a deny list of AWS services. Apply this SCP at each OU level. Leave the default AWS managed SCP at the root level. For any specific exceptions for an OU, remove the standard deny list SCP and add a new deny list SCP for that OU
363
A company has deployed a high performance computing (HPC) cluster in an Amazon VPC. The cluster runs a tightly coupled workload that generates a large number of shared files that are stored in an Amazon EFS file system. The cluster has grown to over 800 instances and the performance has degraded to a problematic level.
A Solutions Architect needs to make some changes to the design to improve the overall performance. Which changes should the Solutions Architect make?
#ERROR!
364
A company runs its IT services from an on-premises data center and is moving to AWS. The company wants to move their development and deployment processes to use managed services where possible. They would like to leverage their existing Chef tools and experience. The application must be deployed to a staging environment and then to production. The ability to roll back quickly must be available in case issues occur following a production deployment.
Which AWS service and deployment strategy should a Solutions Architect use to meet the company’s requirements?
Use AWS OpsWorks and deploy the application using a blue/green deployment strategy
365
A web application allows users to upload video clips of celebrities. The website consists of Amazon EC2 instances and static content. The videos are stored on Amazon EBS volumes and analyzed by custom recognition software for facial analysis. The image processing jobs are picked up from an Amazon SQS queue by an Auto Scaling layer of EC2 instances.
A Solutions Architect has been asked to re-architect the application to reduce operational overhead using AWS managed services where possible. Which recommendations should the Solutions Architect make?
Use an Amazon S3 static website for the web application. Store uploaded videos in an S3 bucket. Use S3 event notification to publish events to the SQS queue. Process the queue with an AWS Lambda functions that calls the Amazon Rekognition API to perform facial analysis
366
A company uses Amazon DynamoDB as the backend for the development environment of a new serverless application. While benchmarking the load, they have configured the RCU and WCU for DynamoDB based on the maximum anticipated load for peak usage.
Peak usage runs over several hours each weekend and is twice the usual load across the week. Within this duration, write operations are significant and take up most of the traffic.
The company must optimize the cost of running the application before releasing to production. Which solution will meet these requirements?
Configure on-demand capacity mode for the table to enable pay-per-request pricing for read and write requests
367
A finance company needs to implement a solution to share a common network across multiple AWS accounts which are a part of an AWS organization.
The company's operations team uses a dedicated operations account with a VPC, and this must be used for network management. Individual accounts cannot have the ability to manage their own networks. However, individual accounts must be able to create AWS resources within subnets.
Which combination of actions should be taken to meet these requirements?
#ERROR!
368
A mobile app has become extremely popular with global usage increasing to millions of users. The app allows users to capture and upload funny images of animals and add captions. The current application runs on Amazon EC2 instances with Amazon EFS storage behind an Application Load Balancer. The data access patterns are unpredictable and during peak periods the application has experienced performance issues.
Which changes should a Solutions Architect make to the application architecture to control costs and improve performance?
Use an Amazon S3 bucket for static images and use the Intelligent Tiering storage class. Use an Amazon CloudFront distribution in front of the S3 bucket and AWS Lambda for processing the images
369
A company leases data center space in a co-location facility and needs to move out before the end of the financial year in 90 days. The company currently runs 150 virtual machines and a NAS device that holds over 50 TB of data. Access patterns for the data are infrequent but when access is required it must be immediate. The VM configurations are highly customized. The company has a 1 Gbps internet connection which is mostly idle and almost completely unused outside of business hours.
Which combination of steps should a Solutions Architect take to migrate the VMs to AWS with minimal downtime and operational impact?
#ERROR!
370
A rapidly growing online retail company is experiencing performance issues during high-traffic events like sales and holidays. The company's current architecture includes a web application running on several Amazon EC2 instances, managed by an Elastic Load Balancer. The application relies on Amazon RDS for data storage. During peak times, the website experiences slow response times and occasional downtime.
Which solution would effectively scale the application architecture to handle high-traffic periods with minimal development effort?
Use Auto Scaling groups for the EC2 instances and enable RDS auto scaling to dynamically adjust the database capacity based on demand
371
A company is setting up a new big data analytics cluster on AWS, which will operate on numerous Linux Amazon EC2 instances distributed across several Availability Zones. The cluster requires a shared file storage system that all nodes can read from and write to. This storage must not only be highly available and resilient but also POSIX-compliant and capable of handling substantial throughput levels.
What storage solution should be adopted to fulfill these criteria?
Establish a new Amazon Elastic File System (Amazon EFS) using the Max I/O performance mode and mount this EFS file system on each EC2 instance in the cluster
372
A healthcare organization is looking to establish a robust disaster recovery (DR) strategy for its patient record management system, currently hosted in their local data center. The system primarily handles two types of data: patient records (text-based) and diagnostic images (large files). Both sets of data are stored on SMB file shares in the data center. The organization requires a backup solution on AWS, ensuring that in case of a disaster, the data can be accessed via SMB from AWS or the data center. The backup data is infrequently accessed but must be retrievable within a short time frame.
Which AWS solution would be most appropriate for these needs?
Deploy an Amazon S3 File Gateway, configuring it to store both patient records and diagnostic images in Amazon S3 Standard-Infrequent Access (S3 Standard-IA), accessible via SMB
373
A company plans to migrate physical servers and VMs from an on-premises data center to the AWS Cloud using AWS Migration Hub. The VMs run on a combination of VMware and Hyper-V hypervisors. A Solutions Architect must determine the best services for data collection and discovery. The company has also requested the ability to generate reports from the collected data.
Which solution meets these requirements?
Use the AWS Application Discovery Service agent for data collection on physical servers and Hyper-V. Use the AWS Agentless Discovery Connector for data collection on VMware. Store the collected data in Amazon S3. Query the data with Amazon Athena. Generate reports by using Amazon QuickSight
374
A company is running an application on an on-premises VMware cluster that must be migrated to an Amazon EC2 instance. While migrating, they wish to preserve the software and configuration settings.
What is the best strategy to meet these requirements?
Use the VMware vSphere client to export the application as an image in Open Virtualization Format (OVF) format. Create an Amazon S3 bucket to store the image in the destination AWS Region. Create and apply an IAM role for VM Import. Use the AWS CLI to run the EC2 import command
375
A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateless application. The application connects to a PostgreSQL database running on a separate server. A Solutions Architect is planning a migration to AWS. The company requires that the application and database layer must be highly available across three availability zones.
Which solution will meet the company’s requirements?
Create an Auto Scaling group of Amazon EC2 instances across three availability zones behind an Application Load Balancer. Create an Amazon Aurora PostgreSQL database in one AZ and add Aurora Replicas in two more AZs
376
A media publishing company has created an online bookstore which gives users access to books and other reference material. These materials can be downloaded by users and new materials can also be uploaded on the portal. According to company requirements, all data must be encrypted in transit and at rest. A solutions architect is building the solution by using Amazon S3 and Amazon CloudFront.
Which combination of steps will meet the encryption requirements?
#ERROR!
377
A company recently migrated a high-traffic eCommerce website to the AWS Cloud. The website is experiencing strong growth. Developers use a private GitHub repository to manage code and the DevOps team use Jenkins for builds and unit testing.
The Developers need to receive notifications when a build does not work and ensure there is no downtime during deployments. It is also required that any changes to production are seamless for users and can be easily rolled back if a significant issue occurs.
A Solutions Architect is finalizing the design for the environment and will use AWS CodePipeline to manage the build and deployment process. What other steps should be taken to meet the requirements?
Use GitHub webhooks to trigger the CodePipeline pipeline. Use the Jenkins plugin for AWS CodeBuild to conduct unit testing. Send alerts to an Amazon SNS topic for any bad builds. Deploy in a blue/green deployment using AWS CodeDeploy
378
An S3 endpoint has been created in an Amazon VPC. A staff member assumed an IAM role and attempted to download an object from a bucket using the endpoint. The staff member received the error message “403: Access Deniedâ€. The bucket is encrypted using an AWS KMS key. A Solutions Architect has verified that the staff member assumed the correct IAM role and the role does allow the object to be downloaded. The bucket policy and NACL are also valid.
Which additional step should the Solutions Architect take to troubleshoot this issue?
Verify that the IAM role has permission to decrypt the referenced KMS key
379
A company is closing an on-premises data center and needs to move some business applications to AWS. There are over 100 applications that run on virtual machines in the data center. The applications are simple PHP, Java, Ruby, and Node.js web applications. The applications are not developed and are not heavily utilized.
A Solutions Architect must determine the best approach to migrate these applications to AWS with the LOWEST operational overhead.
Which method best fits these requirements?
Deploy each application to a single-instance AWS Elastic Beanstalk environment without a load balancer
## Footnote
The simplest option is to upload the application code to Elastic Beanstalk. This will result in a managed environment that runs on Amazon EC2 instances. Elastic Beanstalk is best suited for running web applications that are developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker.
380
A company has created a fitness tracking mobile app the uses a serverless REST API. The app consists of an Amazon API Gateway API with a Regional endpoint, AWS Lambda functions and an Amazon Aurora MySQL database cluster. The company recently secured a deal with a sports company to promote the new app which resulted in a significant increase in the number of requests received.
Unfortunately, the increase in traffic resulted in sporadic database memory errors and performance degradation. The traffic included significant numbers of HTTP requests querying the same data in short bursts of traffic during weekends and holidays.
The company needs to improve its ability to support the additional usage while minimizing the increase in costs associated with the solution.
Which strategy meets these requirements?
Convert the API Gateway Regional endpoint to an edge-optimized endpoint. Enable caching in the production stage
## Footnote
An edge-optimized API endpoint is best for geographically distributed clients. API requests are routed to the nearest CloudFront Point of Presence (POP). For mobile clients this is a good use case for this type of endpoint. The Regional endpoint is best suited to traffic coming from within the Region only
381
An online retailer is updating its catalogue of products. The retailer has a dynamic website which uses EC2 instances for web and application servers. The web tier is behind an Application Load Balancer and the application tier stores data in an Amazon Aurora MySQL database. There is additionally a lot of static content and most website traffic is read-only.
The company is expecting a large spike in traffic to the website when the new catalogue is launched and optimal performance is a high priority.
Which combination of steps should a Solutions Architect take to reduce system response times for a global audience?
- Configure an Aurora global database for storage-based cross-Region replication. Use Amazon S3 with cross-Region replication for static content and resources and create Amazon CloudFront distributions
- Use Amazon Route 53 with a latency-based routing policy. Create Auto Scaling groups for the web and application tiers and deploy them in multiple global Regions
382
What is Aurora Global Database?
Amazon Aurora Global Database is designed for globally distributed applications, allowing a single Amazon Aurora database to span multiple AWS Regions. It replicates your data with no impact on database performance, enables fast local reads with low latency in each Region, and provides disaster recovery from Region-wide outages.
383
A Solutions Architect has deployed a REST API using an Amazon API Gateway Regional endpoint. The API will be consumed by a growing number of US-based companies. Each company will use the API twice each day to get the latest data.
Following the deployment of the API the operations team noticed thousands of requests coming from hundreds of IP addresses around the world. The traffic is believed to be originating from a botnet. The Solutions Architect must secure the API while minimizing cost.
Which approach should the company take to secure its API?
Create an AWS WAF web ACL with a rule to allow access from the IP addresses used by the companies. Associate the web ACL with the API. Create a usage plan with a request limit and associate it with the API. Create an API key and add it to the usage plan
384
What is an API key?
An API key is an alphanumeric string that API developers use to control access to their APIs. An API is a communication mechanism that allows data exchange between two software modules. Once you create an API for your module, other application developers can call your API to integrate your functionality into their code.
385
A company runs an eCommerce web application on a pair of Amazon EC2 instances behind an Application Load Balancer. The application stores data in an Amazon DynamoDB table. Traffic has been increasing with some major sales events and read and write traffic has slowed down considerably over the busiest periods.
Which option provides a scalable application architecture to handle peak traffic loads with the LEAST development effort?
Use Auto Scaling groups for the web application and use DynamoDB auto scaling
386
A company requires an application in which employees can log expense claims for processing. The expense claims are typically submitted each week on a Friday. The application must store data in a format that will allow the finance team to be able to run end of month reports. The solution should be highly available and must scale seamlessly based on demand.
Which combination of solution options meets these requirements with the LEAST operational overhead?
#ERROR!
387
A company wants to host a web application on AWS. The application will be used by users around the world. A Solutions Architect has been given the following design requirements:
· Allow the retrieval of data from multiple data sources.
· Minimize the cost of API calls.
· Reduce latency for user access.
· Provide user authentication and authorization and implement role-based access control.
· Implement a fully serverless solution.
How can the Solutions Architect meet these requirements?
Use Amazon CloudFront with Amazon S3 to host the web application. Use AWS AppSync to build the application APIs. Use Amazon Cognito groups for RBAC. Authorize data access by leveraging Cognito groups in AWS AppSync resolvers
388
What is the usage of AppSync?
Simplify application development with GraphQL APIs by providing a single endpoint to securely query or update data from multiple databases, microservices, and APIs
389
An application currently runs on Amazon EC2 instances in a single Availability Zone. A Solutions Architect has been asked to re-architect the solution to make it highly available and secure. The security team has requested that all inbound requests are filtered for common vulnerability attacks and all rejected requests must be sent to a third-party auditing application.
Which solution meets the high availability and security requirements?
Configure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber
## Footnote
The requirement to send rejected request data to a third-party auditing application can be met by configuring logging in AWS WAF to Kinesis Data Firehose. The destination in Firehose can be configured as the third-party auditing application. Kinesis Firehose supports HTTP destinations as well as Datadog, New Relic, and Splunk.
390
A company runs a web application in an on-premises data center in Paris. The application includes stateless web servers behind a load balancer, shared files in a NAS device, and a MySQL database server. The company plans to migrate the solution to AWS and has the following requirements:
· Provide optimum performance for customers.
· Implement elastic scalability for the web tier.
· Optimize the database server performance for read-heavy workloads.
· Reduce latency for users across Europe and the US.
· Design the new architecture with a 99.9% availability SLA.
Which solution should a Solutions Architect propose to meet these requirements while optimizing operational efficiency?
Use an Application Load Balancer (ALB) in front of an Auto Scaling group of Amazon EC2 instances in one AWS Region and three Availability Zones. Configure an Amazon ElastiCache cluster in front of a Multi-AZ Amazon Aurora MySQL DB cluster. Move the shared files to Amazon EFS. Configure Amazon CloudFront with the ALB as the origin and select a price class that includes the US and Europe
## Footnote
To meet the 99.9% availability SLA a solution in a single Region with Auto Scaling and Load Balancing across multiple AZs is sufficient. To optimize the DB for read-heavy workloads, Amazon ElastiCache can be placed in front of an Aurora MySQL DB. The shared files can be easily moved to an Amazon EFS file system. CloudFront can be used to reduce latency for users in different geographies. In this case US and Europe price classes can be selected in CloudFront and this will cache the content in those locations only which reduces cost
391
A company captures financial transactions in Amazon DynamoDB tables. The security team is concerned about identifying fraudulent behavior and has requested that all changes to items stored in DynamoDB tables must be logged within 30 minutes.
How can a Solutions Architect meet this requirement?
Use Amazon DynamoDB Streams to capture and send updates to AWS Lambda. Create a Lambda function to output records to Amazon Kinesis Data Streams. Analyze any anomalies with Amazon Kinesis Data Analytics. Send SNS notifications when anomalous behaviors are detected
392
A company is creating a multi-account structure using AWS Organizations. The accounts will include the Management account, Production account, and Development account. The company requires auditing for all API actions across accounts. A Solutions Architect is advising the company on how to configure the accounts. Which of the following recommendations should the Solutions Architect make?
#ERROR!
393
A company runs several IT services in an on-premises data center that is connected to AWS using an AWS Direct Connect (DX) connection. The service data is sensitive and the company uses an IPSec VPN over the DX connection to encrypt data. Security requirements mandate that the data cannot traverse the internet. The company wants to offer the IT services to other companies who use AWS.
Which solution will meet these requirements?
Create a VPC Endpoint Service that accepts TCP traffic and host it behind a Network Load Balancer. Enable access to the IT services over the DX connection
394
A company runs a two-tier application that uses EBS-backed Amazon EC2 instances in an Auto Scaling group and an Amazon Aurora PostgreSQL database. The company intends to use a pilot light approach for disaster recovery in a different AWS Region. The company has an RTO of 6 hours and an RPO of 24 hours.
Which solution would achieve the requirements with MINIMAL cost?
Use AWS Lambda to create daily EBS snapshots and copy them to the disaster recovery Region. Implement an Aurora Replica in the DR Region. Use Amazon Route 53 with an active-passive failover configuration. Use Amazon EC2 in an Auto Scaling group with the capacity set to 0 in the disaster recovery Region
395
A company uses AWS CodePipeline to manage an application that runs on Amazon EC2 instances in an Auto Scaling group. All AWS resources are defined in CloudFormation templates. Application code is stored in an Amazon S3 bucket and installed at launch time using lifecycle hooks with EventBridge and AWS Lambda. Recent changes in the CloudFormation templates have resulted in issues that have caused outages and management require a solution to ensure this situation is not repeated.
What should a Solutions Architect do to reduce the likelihood that future changes in the templates will cause downtime?
Use AWS CodeBuild for automated testing. Use CloudFormation changes sets to evaluate changes ahead of deployment. Use AWS CodeDeploy to leverage blue/green deployment patterns
396
A company is running several development projects. Developers are assigned to a single project but move between projects frequently. Each project team requires access to different AWS resources.
Currently, there are projects for serverless, analytics, and database development. The resources used within each project can change over time. Developers require full control over the project they are assigned to and no access to the other projects.
When developers are assigned to a different project or new AWS resources are added, the company wants to minimize policy maintenance.
What type of control policy should a Solutions Architect recommend?
Create a customer managed policy document for each project that requires access to AWS resources. Specify full control of the resources that belong to the project. Attach the project-specific policy document to an IAM group. Change the group membership when developers change projects. Update the policy document when the set of resources changes
397
A Solutions Architect must enable an AWS CloudHSM M of N access control—also named a quorum authentication mechanism—to allow security officers to make administrative changes to a hardware security module (HSM). The new security policy states that at least two of the four security officers must authorize any administrative changes to CloudHSM. This is the first time this configuration has been setup. Which steps must be taken to enable quorum authentication
#ERROR!
398
Solutions Architect has been tasked with migrating an application to AWS. The application includes a desktop client application and web application. The web application has an uptime SLA of 99.5%. The Solutions Architect must re-architect the application to meet or exceed this SLA.
The application contains a MySQL database running on a single virtual machine. The web application uses multiple virtual machines with a load balancer. Remote users complain about slow load times while using this latency-sensitive application.
The Solutions Architect must minimize changes to the application whilst improving the user experience, minimizing costs, and ensuring the availability requirements are met. Which solutions best meets these requirements?
Migrate the database to an Amazon RDS Aurora MySQL configuration. Host the web application on an Auto Scaling configuration of Amazon EC2 instances behind an Application Load Balancer. Use Amazon AppStream 2.0 to improve the user experience
399
A multinational corporation with offices in different regions has several AWS accounts, each managed by local IT teams. The corporation's central IT department, based in their headquarters, needs to gain oversight, and implement standardized security policies across all these regional AWS accounts.
A solutions architect is tasked with enabling the central IT department to efficiently manage security policies and monitor compliance across all regional AWS accounts. After setting up AWS Organizations and inviting all regional accounts to join, what should be the next step to meet these requirements?
In each regional account, establish the SecurityAudit IAM role and grant permission to the central account to assume this role
400
In a corporation using AWS Organizations, there's a requirement to supervise Amazon EC2 resource utilization across different accounts. The goal is to create a mechanism that sends daily notifications to the company's IT architecture team when the EC2 resource usage exceeds the average of the previous 45 days by more than 15%.
What strategy should be employed to meet this objective?
Set up a monitoring system in the organization's central account using AWS Budgets. Focus on tracking the hours of EC2 instance operation, setting a monitoring interval to daily. Define a budget limit that is 15% above the 45-day average usage of EC2, as determined by AWS Cost Explorer, and configure alerts for the architecture team when this limit is reached
401
An Amazon RDS database was created with encryption enabled using an AWS managed CMK. The database has been reclassified and no longer requires encryption. How can a Solutions Architect unencrypt the database with the LEAST operational overhead?
Export the data from the DB instance and import the data into an unencrypted DB instance
402
A company needs to host a highly available and secure image processing application in AWS. Their VPC architecture consists of a public and a private subnet within an Amazon VPC traversing two Availability Zones.
The application is hosted on Amazon EC2 instances in the private subnet. The application needs to communicate with the internet via two NAT gateways and uses an Application Load Balancer in the public subnet. Images are stored in an Amazon S3 bucket which average around 1 TB in new objects per day.
A solutions architect must reduce the associated cost of the solution and reduce manual effort while maintaining security.
How can this be accomplished?
Set up an S3 gateway VPC endpoint in the VPC. Attach an endpoint policy to the endpoint to allow the required actions on the S3 bucket
## Footnote
There are already two NAT gateways in place but Amazon S3 and DynamoDB come with the option to place gateway endpoints in the VPC which provide reliable connectivity to Amazon S3 without requiring an internet gateway or a NAT device for your VPC. There is no additional charge for using gateway endpoints and this is a secure method of connecting to these service endpoints without using public IP addresses. The cost of the solution can then be reduced as the NAT gateways would no longer be needed.
403
An e-commerce company has developed a newer version of a shopping application with many new features. But before rolling it out to the public, they want to test the new version incrementally using small incremental deployments. The application is deployed using AWS CloudFormation and uses multiple AWS Lambda functions.
Which solution will meet these requirements?
Enable versioning for the AWS Lambda function and associate an alias for every new version. Use the AWS CLI ‘update-alias’ command with the ‘routing-config’ parameter to distribute the load
404
A company runs a single application in an AWS account. The application uses an Auto Scaling Group of Amazon EC2 instances with a combination of Reserved Instances (RIs) and On-Demand instances. To maintain cost-effectiveness the RIs should cover 70% of the workload. The solution should include the ability to alert the DevOps team if coverage drops below the 70% threshold.
Which set of steps should a Solutions Architect take to create the report and alert the DevOps team?
Use AWS Budgets to create a budget for Rl coverage and set the threshold to 70%. Configure an alert that notifies the DevOps team
405
A serverless application uses an AWS Lambda function behind and Amazon API Gateway REST API. During busy periods thousands of simultaneous invocations are required and requests fail multiple times before succeeding. The operations team has checked for AWS Lambda errors and did not find any. A Solutions Architect must investigate the root cause of the issue. What is the most likely cause of this problem?
The throttle limit on the REST API is configured too low. During busy periods some requests are being throttled and are not reaching the Lambda function
## Footnote
Throttling can be configured for API Gateway at the stage or usage plan level. Amazon API Gateway provides two basic types of throttling-related settings:
* Server-side throttling limits are applied across all clients. These limit settings exist to prevent your API—and your account—from being overwhelmed by too many requests.
* Per-client throttling limits are applied to clients that use API keys associated with your usage policy as client identifier.
406
A financial services company is developing a secure web application on AWS. This application will handle sensitive customer data and needs to be accessible only within the company's corporate network. The application is hosted on Amazon EC2 instances within a VPC. The company wants to ensure that this web application is not accessible from the public internet for enhanced security.
As AWS solutions architect must ensure that the web application is only accessible from the company's corporate network and not from the public internet. Which action should be taken?
Create a VPN connection between the company’s corporate network and the VPC. Configure security groups for the EC2 instances to only allow traffic from the VPN connection
407
A media company runs an application that uses a static website configured in an Amazon S3 bucket and an Amazon CloudFront distribution. The website calls an Amazon API Gateway REST API, and an AWS Lambda function backs each API method.
The company wants to generate a CSV report every 2 weeks that records the following for each Lambda function:
· Recommended configured memory.
· Recommended cost.
· Price difference between current configurations and the recommendations.
Which solution will meet these requirements with the LEAST development time?
Use AWS Compute Optimizer. Call the “ExportLambdaFunctionRecommendations†operation for the Lambda functions. Export the .csv file to an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks
408
A company uses an AWS account with resources deployed in multiple Regions globally. Operations teams deploy and manage resources within each Region. Some Region-specific service quotas have been reached causing an inability for the local operations teams to deploy resources. A centralized cloud team is responsible for monitoring and updating service quotas. The cloud team needs to create an automated and operationally efficient solution to proactively monitor service quotas. Monitoring should occur every 15 minutes and send alerts when a team exceeds 80% utilization.
Which solution will meet these requirements?
Create an Amazon EventBridge rule that triggers an AWS Lambda function to use AWS Trusted Advisor to retrieve the most current utilization and service limit data. If the current utilization is above 80%, publish a message to an Amazon SNS topic to alert the cloud team
409
A company runs a high performance computing (HPC) application in an on-premises data center. The solution consists of a 10-node cluster running Linux with high-speed inter-node connectivity. The company is planning to migrate the application to the AWS Cloud. A Solutions Architect needs to design the solution architecture on AWS to ensure optimum performance for the HPC cluster.
Which combination of steps will meet these requirements?
#ERROR!
410
A financial company stores personally identifiable information (PII) in an Amazon S3 bucket which currently does not have versioning enabled. The current configuration has server-side encryption with S3 managed encryption keys (SSE-S3) enabled to encrypt the objects. According to a new requirement, all current and future objects in the S3 bucket must be encrypted by keys that the company's security team manages.
Which solution will meet these requirements?
Change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS) in S3 bucket. Set an S3 bucket policy to deny unencrypted PutObject requests. Use the AWS CLI to re-upload all objects in the S3 bucket
411
An application runs on a fleet of Amazon ECS instances and stores data in an Amazon S3 bucket. Until recently the application had been working well and then started to fail to upload objects to the S3 bucket. Server access logging has been enabled and 403 errors have been identified since the time of the fault. The ECS cluster has been setup according to best practices and no changes have been made to the S3 bucket policy or IAM roles used to access the bucket.
What is the most LIKELY cause of the failure?
The ECS task IAM role was modified
412
A corporation is seeking to develop a disaster recovery (DR) plan for its web application, which is currently operational in a single AWS Region. This application utilizes a microservices architecture with services running on AWS Fargate within Amazon Elastic Container Service (ECS). The data layer is handled by an Amazon RDS for MySQL database, and DNS management is conducted through Amazon Route 53. An Amazon CloudWatch alarm is configured to trigger an Amazon EventBridge rule in the event of an application failure.
The task is to design a DR strategy that enables quick restoration of the application in a different AWS Region following a failure.
Which approach would best meet these requirements?
Set up a standby ECS cluster and service on Fargate in a different Region. Create a cross-Region RDS read replica in this new Region. Design an AWS Lambda function to promote the read replica to a primary database and reconfigure Route 53 to reroute traffic to the standby ECS cluster. Adjust the EventBridge rule to include this Lambda function as a target
413
A start-up company has created a new serverless application which includes an AWS Lambda function which sits behind an Amazon API gateway and an Amazon CloudFront CDN. The development team is currently using AWS CLI scripts to update the versions of Lambda functions. In case an error is detected, a different CLI script is used to roll back the version to the previous stable one.
A solutions architect needs to optimize this process and reduce the time taken to switch versions and detect the error in Lambda functions.
How can this be accomplished?
Use AWS SAM and built-in AWS CodeDeploy to deploy the new Lambda version, gradually shift traffic to the new version, and use pre-traffic and post-traffic test functions to verify code. Rollback in case Amazon CloudWatch alarms is triggered
## Footnote
AWS CodeDeploy leverages Lambda’s traffic shifting capabilities to automate the gradual rollout of new function versions. It can also help you use deployment best practices, such as testing a new change on a small portion of traffic before deploying it to all customers. For example, CodeDeploy lets you automate pre-deployment tests that a function must pass before it begins taking traffic. You can also set alarms that automatically trigger rollbacks in the event of errors.
414
A company needs to deploy an application into an AWS Region across multiple Availability Zones and has several requirements for the deployment. The application requires access to 100 GB of static data before the application starts and must be able to scale up and down quickly. Startup time must be minimized as much as possible. The Operations team must be able to install critical OS patches within 48 hours of release. The solution should also be cost-effective.
Which deployment strategy meets these requirements?
Use Amazon EC2 Auto Scaling with an AMI that includes the latest OS patches. Mount an Amazon EFS file system with the static data to the EC2 instances at launch time
## Footnote
An Auto Scaling group should be used across multiple AZs. The AMI included should include the latest OS patches and the launch config / template should be replaced with a new AMI that includes updated OS patches whenever the critical patches are released. An Amazon EFS file system can be mounted to the instances that has the 100 GB of static data.
415
A manufacturing company collects data from IoT devices in JSON format. The data is collected, transformed, and stored in a data warehouse for analysis using an analytics tool that uses ODBC. The performance of the current solution suffers under high loads due to insufficient compute capacity and incoming data is often lost.
The application will be migrated to AWS. The solution must support the current analytics tool, resolve the compute constraints, and be cost-effective.
Which solution meets these requirements?
Re-architect the application. Load the data into Amazon S3. Use AWS Glue to transform the data. Store the table schema in an AWS Glue Data Catalog. Use Amazon Athena to query the data
416
A start-up company has been using bastion hosts to connect to EC2 instances which are based on the latest Amazon Linux 2 AMI. They use these bastion hosts to SSH into EC2 instances to view logs and other troubleshooting activities.
So far, they have configured a VPC with private and public subnets, and a NAT gateway. Also, they have a Site-to-Site VPN for connectivity with the on-premises environment and EC2 security groups with direct SSH access from the on-premises environment
To increase security control and comply with auditing requirements around access to instances, which strategy should a solutions architect use?
Create an IAM role with the AmazonSSMManagedInstanceCore managed policy attached. Attach the IAM role to all the EC2 instances. Remove all security group rules attached to the EC2 instances that allow inbound TCP on port 22. Have the engineers install the AWS Systems Manager Session Manager plugin for their devices and remotely access the instances by using the start-session API call from Systems Manager
417
A healthcare organization is planning to transition its on-premises data processing workloads to AWS. Before migration, the organization needs a thorough assessment of its current server infrastructure to determine appropriate sizing for Amazon EC2 instances. Key data to be collected includes CPU and memory usage, network I/O, and a list of active services on each server. Additionally, the organization wants to analyze network traffic patterns to understand dependencies between servers.
What is the most cost-effective method to gather this comprehensive data for migration planning?
Implement AWS Application Discovery Service with the installation of its data collection agent on each server in the organization's data center to gather detailed server usage and network data
## Footnote
AWS Application Discovery Service is specifically designed to assist organizations in collecting detailed information about their on-premises infrastructure, which is crucial for cloud migration planning.
By deploying the data collection agent on each server, the organization can obtain in-depth data on server performance, including CPU and memory usage, network I/O, and running services.
This detailed level of data collection, including network traffic analysis, is essential for accurately determining the sizing and configuration of Amazon EC2 instances for the migration.
418
An online shopping portal is running in eu-west-1 region. One of the application components uses AWS Lambda functions and stores inventory data in an Amazon Aurora database. Deployment of the Lambda functions is performed using a deployment package. The company has configured automated backups for Aurora.
The company wants to move the application to another AWS account within the same AWS organization. The application processes critical data and downtime must be minimized or avoided if possible.
Which solution will meet the requirements for moving this application from the source account to the target account?
Download the Lambda function package from the source account. Use the deployment package and create new Lambda functions in the target account. Share the Aurora DB cluster with the target account by using AWS Resource Access Manager (AWS RAM). Grant the Target account permission to clone the Aurora DB cluster
419
A fleet of EC2 instances generate a large quantity of data and store the data on an Amazon EFS file system. The EC2 instances also backup the data by uploading to an Amazon S3 bucket in another Region on a daily basis. Some S3 uploads have been failing and the storage costs have significantly increased.
The operations team has removed the failed uploads. How can a Solutions Architect configure the backup jobs to efficiently backup data to S3 while reducing storage costs?
#ERROR!
420
An application publishes data continuously to Amazon DynamoDB using an AWS Lambda function. The DynamoDB table has an auto scaling policy enabled with the target utilization set to 70%. There are short predictable periods in which a large volume of data is received and this can exceed the typical load by up to 300%. The AWS Lambda function writes
ProvisionedThroughputExceededException messages to Amazon CloudWatch Logs during these times, and some records are redirected to the dead letter queue.
What change should the company make to resolve this issue?
Use Application Auto Scaling to scale out write capacity on the DynamoDB table based on a schedule
421
A company's serverless application, comprising several AWS Lambda functions and Amazon DynamoDB tables, is undergoing an upgrade to include interaction with an Amazon Neptune DB cluster. This cluster is distributed across two subnets within a VPC.
Identify two solutions that would enable the Lambda functions to access both the Neptune DB cluster and the DynamoDB tables
#ERROR!
422
A security team has discovered that developers have been storing IAM secret access keys in AWS CodeCommit repositories. The security team requires that measures are put in place to automatically find and remediate all instances of this vulnerability on an ongoing basis.
Which solution meets these requirements?
Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials. If any credentials are found, disable them and notify the user
## Footnote
You can configure a CodeCommit repository so that code pushes or other events trigger actions, such as sending a notification from Amazon Simple Notification Service (Amazon SNS) or invoking a function in AWS Lambda. You can create up to 10 triggers for each CodeCommit repository. In this case you can trigger AWS Lambda to scan the code for access keys
423
A development team created a service that uses an AWS Lambda function to store information in an Amazon RDS Database. The database credentials are stored in clear text in the Lambda function code. A Solutions Architect is advising the development team on how to better secure the service. What should the Solutions Architect recommend?
#ERROR!
424
An application runs across a fleet of Amazon EC2 instances in an Auto Scaling group. Application logs are collected from the EC2 instances using a cron job that is scheduled to run every 30 minutes. The cron job saves the log files to an Amazon S3 bucket. Failures and scaling events have caused some logs to be lost as the instances have been lost before the cron job collected the log files.
Which option is the MOST reliable way of collecting and preserving the log files?
Use the Amazon CloudWatch Logs agent to stream log messages directly to CloudWatch Logs. Configure the batch_count parameter to 1
## Footnote
The batch_count parameter specifies the max number of log events in a batch, up to 10000. Using a value of 1 will result in every log entry being immediately streamed to CloudWatch Logs.
425
A company has an application that generates data exports which are saved as CSV files in an Amazon S3 bucket. The data is generally confidential and only accessed by IAM users. An individual CSV file must be shared with an external organization. A Solutions Architect used an IAM user account to attempt to perform a PUT Object call to enable a public ACL on the object and it failed with “insufficient permissionsâ€.
What is the most likely cause of this issue?
The bucket has the BlockPublicAcls setting set to TRUE
426
Solutions Architect wants to make sure that only IAM users with appropriate permissions can access a new Amazon API Gateway endpoint. How can the Solutions Architect design the API Gateway access control to meet this requirement?
Set the authorization to AWS_IAM for the API Gateway method. Create a permissions policy that grants execute-api:Invoke permission on the REST API resource and attach it to a group containing the IAM user accounts
427
An application runs on Amazon EC2 instances in a private subnet within an Amazon VPC. The application stores files in a specific Amazon S3 bucket. The files should not traverse the internet and only the application instances should be granted access to save files to the S3 bucket. A gateway endpoint has been created for Amazon S3 and connected to the Amazon VPC.
What additional steps should a Solutions Architect take to meet the stated requirements?
Attach an endpoint policy to the gateway endpoint that restricts access to the specific S3 bucket. Assign an IAM role to the EC2 instances and attach a policy to the S3 bucket that grants access only to this role
428
A company is planning to migrate a containerized application to Amazon ECS. The company wishes to reduce instance costs as much as possible whilst reducing the probability of service interruptions. How should a Solutions Architect configure the solution?
Use Amazon ECS Spot instances and configure Spot Instance Draining
429
A company runs a Java application on Amazon EC2 instances. The DevOps team uses a combination of Amazon CloudFormation and AWS OpsWorks to update the infrastructure and application stacks respectively. During recent updates the DevOps team reported service disruption issues that affected the Java application running on the Amazon EC2 instances.
Which solution will increase the reliability of application updates?
Implement a blue/green deployment strategy
430
A web application is being deployed on Amazon EC2 instances and requires that users authenticate before they can access content. The solution needs to be configured so that it is highly available. Once authenticated, users should remain connected even if an underlying instance fails.
Which solution will meet these requirements?
Create an Auto Scaling group for the EC2 instances and use an Application Load Balancer to direct incoming requests. Use Amazon DynamoDB to save the authenticated connection details
431
An eCommerce website consists of a two-tier architecture. Amazon EC2 instances in an Auto Scaling group are used for the web server layer behind an Application Load Balancer (ALB). The web servers run a PHP application on Apache Tomcat. The database layer runs on an Aurora MySQL database instance.
Recently, a large sales event caused some errors to occur for customers when placing orders on the website. The operations team collected logs from the web servers and reviewed Aurora DB cluster performance metrics. Several web servers were terminated by the ASG before the logs could be collected and the Aurora metrics were not sufficient for query performance analysis.
Which combination of steps should a Solutions Architect take to improve application performance visibility during peak traffic events?
#ERROR!
432
A company has a security policy that requires that all internal application connectivity must use private IP addresses. A Solutions Architect has created interface endpoints in private subnets to connect to AWS public services. The Solutions Architect tested the configuration and the connectivity failed.
Which configuration change should the Solutions Architect make to resolve the issue?
Configure the security group on the interface endpoint to allow connectivity to the AWS services
433
A company has a line of business (LOB) application that is used for storing sales data for an eCommerce platform. The data is unstructured and stored in an Oracle database running on a single Amazon EC2 instance. The application front end consists of six EC2 instances in three Availability Zones (AZs). Each week the application receives bursts of traffic and application performance suffers. A Solutions Architect must design a solution to address scalability and reliability. The solutions should also eliminate licensing costs.
Which set of steps should the Solutions Architect take?
Create an Auto Scaling group for the front end with a combination of Reserved instances and Spot Instances to reduce costs. Convert the tables in the Oracle database into Amazon DynamoDB tables
434
A secure web application runs in an Amazon VPC that has a public subnet and a private subnet. An Application Load Balancer is deployed into the public subnet. Each subnet has a separate Network ACL. The public subnet CIDR range is 10.1.0.0/24 and the private subnet CIDR range is 10.1.1.0/24. The web application is deployed on Amazon EC2 instances in the private subnet. Which combination of rules should be defined on the private subnet’s Network ACL to allow access from internet-based clients?
- An inbound rule for port 443 from source 10.1.0.0/24
- An outbound rule for ports 1024 through 65535 to destination 10.1.0.0/24
435
A company has several Amazon RDS databases each with over 50 TB of data. Management have requested that ability to generate a weekly business report from the databases. The system should support ad-hoc SQL queries.
What is the MOST cost-effective solution for the Business Intelligence platform?
Configure an AWS Glue crawler to crawl the databases and create tables in the AWS Glue Data Catalog. Create an AWS Glue ETL job that loads data from the RDS databases to Amazon S3. Use Amazon Athena to run the queries
436
A company stores highly confidential information in an Amazon S3 bucket. The security team have evaluated the security of the configuration and have come up with some new requirements that must be met. The security team now requires the ability to identify the IP addresses that make requests to the bucket to be able to identify malicious actors. They additionally require that any changes to the bucket policy are automatically remediated and alerts of these changes are sent to their team members.
Which strategies should a Solutions Architect use to meet these requirements?
Identify the IP addresses in Amazon S3 requests with Amazon S3 access logs and Amazon Athena. Use AWS Config with Auto Remediation to remediate any changes to S3 bucket policies. Configure alerting with AWS Config and Amazon SNS
437
A car rental company operates a serverless REST API, which includes an Amazon API Gateway with a Regional endpoint, AWS Lambda functions, and an Amazon Aurora MySQL Serverless DB cluster. This API, initially serving a mobile app, has been extended to partner mobile apps, leading to a substantial increase in requests and occasional database memory errors. Analysis shows that clients frequently make repeated HTTP GET requests for the same queries in short intervals, especially during business hours and around holidays.
To enhance the system's capacity to handle this increased load without significantly raising costs, what approach should the company adopt?
Integrate an Amazon ElastiCache for Redis layer to cache database query results. Update the Lambda functions to retrieve data from this cache when available
438
An on-premises analytics database running on Oracle will be migrated to the cloud. The database runs on a single virtual machine (VM) and multiple client VMs running a Java-based web application that is used to perform SQL queries on the database. All virtual machines will be migrated to the cloud. The database uses 2 TB of storage and each client VM has a different configuration and saves stored procedures and query results in the local file system. There is a 10 Gbit AWS Direct Connect (DX) connection established and the application can be migrated over a scheduled 48-hour change window.
Which strategy will reduce the operational overhead on the database and have the LEAST impact on the operations staff after the migration?
Use AWS DMS to migrate the database to Amazon RDS. Replicate the client VMs into AWS using AWS SMS. Create Route 53 A records for each client VM
439
A Solutions Architect is designing a publicly accessible web application that runs from an Amazon S3 website endpoint. The S3 website is the origin for an Amazon CloudFront distribution. After deploying the solution the operations team ran some tests and received an “Error 403: Access Denied message†when attempting to connect.
What should the Solutions Architect check to determine the root cause of the issue?
#ERROR!
440
A company is creating a secure data analytics solution. Data will be uploaded into an Amazon S3 bucket. The data will then be analyzed by applications running on an Amazon EMR cluster that is launched into a VPC in a private subnet. The environment must be fully isolated from the internet at all times. Data must be encrypted at rest using keys that are controlled and provided by the company.
Which combination of actions should a Solutions Architect take to meet these requirements?
#ERROR!
441
A business is in the process of setting up an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to manage a specific workload. This workload is expected to generate a highly variable number of stateless pods, with a significant number of these pods being launched in a brief timeframe due to automatic scaling of replicas.
What approach should be taken to optimize the resilience of the nodes in this scenario?
Adjust the workload configuration to utilize topology spread constraints based on different Availability Zones
442
A new employee is joining a security team. The employee initially requires access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. All security team members are added to the security team IAM group that provides additional permissions to manage all other AWS services.
The team lead wants to limit the permissions the new employee has access to until the employee takes on additional responsibilities, and then be able to easily add permissions as required, eventually providing the same access as all other security team employees.
How can the team lead limit the permissions assigned to the new user account whilst minimizing complexity?
Create an IAM account for the new employee and add the account to the security team IAM group. Set a permissions boundary that grants access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add the additional services to the permissions boundary IAM policy
443
An eCommerce company runs an application that records product registration information. The application uses an Amazon S3 bucket for storing files and an Amazon DynamoDB table to store customer record data. The application software runs in us-west-1 and eu-central-1. The S3 bucket and DynamoDB table are in us-west-1. A Solutions Architect has been asked to implement protection from data corruption and the loss of connectivity to either Region.
Which solution meets these requirements?
Create a DynamoDB global table to replicate data between us-west-1 and eu-central-1. Enable continuous backup on the DynamoDB table in us-west-1 . Set up S3 cross-region replication from us-west-1 to eu-central-1
## Footnote
A DynamoDB global table is a multi-region, multi-active database. This means you can create a table and write to that table in multiple Regions and AWS synchronizes the items. This provides the required redundancy for the database table. DynamoDB continuous backups can be enabled. This provides per-second granularity and restore to any single second from the time PITR was enabled up to the prior 35 days. This protects against data corruption
444
A company is planning a move to the AWS Cloud and is creating an account strategy. There are various teams in the company and each team prefers to keep their resources isolated from other teams. The Finance team would like each team’s resource usage separated for billing purposes. The Security team will provide permissions to each team using the principle of least privilege.
Which account strategy will meet all of these requirements?
Use AWS Organizations to create a management account and create each team’s account from the management account. Create a security account for cross-account access. Apply service control policies on each account and grant the security team cross-account access to all accounts. The Security team will create IAM policies to provide least privilege access.
445
A company hosts a business-critical monolithic application on an Amazon EC2 instance which is installed on an instance launched from an Amazon Linux 2 AMI. The company requires that the data on the attached EBS volumes must be backed up to a specific Amazon S3 bucket managed by the company.
The security team has mandated against owning any SSH keys for instances, so the operations team are unable to SSH into the instance.
Which solution will meet these requirements with the least impact on the critical application?
Take a snapshot of the EBS volume by using Amazon Data Lifecycle Manager (Amazon DLM). Use the EBS direct APIs to copy the data from the snapshot to Amazon S3
## Footnote
Amazon Data Lifecycle Manager provides an automated, policy-based lifecycle management solution for Amazon Elastic Block Store (EBS) Snapshots and EBS-backed Amazon Machine Images (AMIs). Automate the creation of point-in-time copy of your block storage data with user-defined policies that you can customize based on data protection needs. Amazon Data Lifecycle Manager requires no scripting or special training
446
A company has connected their on-premises data center to AWS using a single AWS Direct Connect (DX) connection using a private virtual interface. The company is hosting the front end for a business-critical application in an Amazon VPC. The back end is hosted on-premises and the company requires consistent, reliable, and redundant connectivity between the front end and back end of the application.
Which design would provide the MOST resilient connectivity between AWS and the on-premises data center?
Install a second DX connection from a different network carrier and attach it to the same virtual private gateway as the first DX connection
447
The security department of a large company with several AWS accounts wishes to centralize the management of identities and AWS permissions. The design should also synchronize authentication credentials with the company’s existing on-premises identity management provider (IdP).
Which solution will meet the security department’s requirements?
Create a SAML-based identity management provider in a central account and map IAM roles that provide the necessary permissions for users. Map users in the on-premises IdP groups to IAM roles. Use cross-account access to the other AWS accounts
448
An application runs in us-east-1 and consists of Amazon EC2 instances behind an Application Load Balancer (ALB) and an Amazon RDS MySQL database. The company is creating a disaster recovery solution to a second AWS Region (us-west-1). A solution has been created for replicating AMIs across Regions and an ALB is provisioned in us-west-1. Amazon Route 53 failover routing is configured appropriately. A Solutions Architect must complete the solution by designing the disaster recovery processes for the storage layer. The RPO is 5 minutes and the RTO is 15 minutes. The solution must be fully automated.
Which set of actions would complete the disaster recovery solution?
Create a cross-Region read replica in us-west-1. Use Amazon EventBridge to trigger an AWS Lambda function that promotes the read replica to primary and updates the DNS endpoint address for the database
449
A Solutions Architect is designing a highly available infrastructure for a popular mobile application that offers games and videos for mobile phone users. The application runs on Amazon EC2 instances behind an Application Load Balancer. The database layer consist of an Amazon RDS MySQL Multi-AZ instance. The entire application stack is deployed across us-east-2 and us-west-1. Amazon Route 53 is configured to route traffic to the two deployments using a latency-based routing policy.
A testing team blocked access to the Amazon RDS DB instance in us-east-2 to verify that users who are typically directed to that deployment would be directed to us-west-1. This did not occur and users close to us-east-2 were directed there and the application failed.
Which changes to the infrastructure should a Solutions Architect make to resolve this issue?
- Write a custom health check that verifies successful access to the database endpoints in each Region. Add the health check within the latency-based routing policy in Amazon Route 53
- Set the value of Evaluate Target Health to Yes on the latency alias resources for both us-east-2 and us-west-1
450
A rapidly growing company has registered 10 new domain names for multiple applications soon to be productionized. The company uses the domains for online marketing. The company needs a solution that will redirect online visitors to a specific URL and route combination for each domain. The URL and route combinations are defined in a JSON document. All DNS records are managed by Amazon Route 53. They also need to accept HTTP and HTTPS requests.
Which combination of steps should a solutions architect take to meet these requirements with the LEAST amount of operational effort?
- Create an Application Load Balancer that includes HTTP and HTTPS listeners
- Create an Amazon CloudFront distribution and deploy a Lambda@Edge function
- Create an SSL certificate by using AWS Certificate Manager (ACM). Include the domains as Subject Alternative Names
451
An application generates around 15 GB of statistical data each day and this is expected to increase over time. A Solutions Architect plans to store the data in Amazon S3 and use Amazon Athena to analyze the data. The data will be analyzed using date ranges.
Which combination of steps will ensure optimal performance as the data grows?
#ERROR!
452
A healthcare company has developed a series of microservices for processing patient data, hosted on AWS. These microservices are accessed through REST APIs managed by Amazon API Gateway. To comply with healthcare regulations, the company needs to ensure that these APIs are only accessible from their internal application, which runs on an Amazon EC2 instance within their AWS VPC. The application must securely access these APIs without exposing them to the public internet.
Which step should a solutions architect take to ensure that the REST APIs are securely accessible by the internal application, while complying with the healthcare regulations?
Create an interface VPC endpoint for API Gateway in the VPC. Enable private DNS naming for the VPC endpoint and configure an API resource policy that allows access from the VPC endpoint. Use the API endpoint's DNS names to access the API from the EC2 instance
453
A Solutions Architect must design a solution for providing private connectivity from a company’s WAN network to multiple AWS Regions. The company has offices around the world and has its main data center in New York. The company has mandated that traffic must not traverse the public internet at any time. The solution must also be highly available.
How can the Solutions Architect meet these requirements?
Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use Direct Connect Gateway to access data in other AWS Regions
454
A multinational corporation offers a web-based customer relationship management (CRM) tool that operates in the AWS Cloud. The tool is hosted on Amazon EC2 instances situated behind an Application Load Balancer (ALB), with instances spread across multiple Availability Zones within a single AWS Region. As part of its expansion strategy, the corporation plans to deploy the tool in several new AWS Regions.
To comply with customer security policies, the corporation needs to provide fixed IP addresses for the tool so that customers can include these IPs in their firewall allow lists. Additionally, the corporation wants to ensure that users are automatically directed to the nearest regional deployment for optimal performance.
Which solution would fulfill these requirements?
Implement AWS Global Accelerator with a standard accelerator configuration. Associate each regional deployment's ALB with the Global Accelerator and distribute its static IP addresses to customers
## Footnote
AWS Global Accelerator provides static IP addresses as a core feature, which can be used by customers for their firewall allow lists
455
An eCommerce application offers a membership program. Members of the program need to be able to download all files in a secured Amazon S3 bucket. The access should be restricted to members of the program and not available to anyone else. An Amazon CloudFront distribution has been created to deliver the content to users around the world.
What is the most efficient method a Solutions Architect should use to securely enable access to the files in the S3 bucket?
Configure the application to send Set-Cookie headers to the viewer and control access to the files using signed cookies
456
A company is in the planning stages for an application projected to hold around 15 TB of data. They require a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 15 minutes. The team is seeking a database solution that not only meets these recovery objectives but also allows for cost-effective failover to a backup AWS Region.
Which database solution aligns best with these requirements while minimizing costs?
Configure an Amazon RDS instance with a cross-Region read replica in an alternative Region. Should the primary Region fail, promote the read replica to become the new primary database
457
A company needs to close a data center and must migrate data to AWS urgently. The data center has a 1 Gbps internet connection and a 500 Mbps AWS Direct Connect link. The company must transfer 25 TB of data from the data center to an Amazon S3 bucket.
What is the FASTEST method of transferring the data?
Upload the data to the S3 bucket using S3 Transfer Acceleration
458
A company is migrating an application into AWS. The application code has already been installed and tested on Amazon EC2. The database layer consists of a 25 TB MySQL database in the on-premises data center. There is a 50 Mbps internet connection and an IPSec VPN connection to the Amazon VPC. The company plans to go live on AWS within 2 weeks.
Which combination of actions will meets the migration schedule with the LEAST downtime?
#ERROR!
459
A company has launched a web application on Amazon EC2 instances. The instances have been launched in a private subnet. An Application Load Balancer (ALB) is configured in front of the instances. The instances are assigned to a security group named WebAppSG and the ALB is assigned to a security group named ALB-SG. The security team requires that the security group rules are locked down according to best practice.
What rules should be configured in the security groups?
- An inbound rule in WebAppSG allowing port 80 from source ALB-SG
- An inbound rule in ALB-SG allowing port 80 from source 0.0.0.0/0
460
A company is planning to launch a new web application on AWS using a fully serverless design. The website will be used by global customers and should be highly responsive and offer minimal latency. The design should be highly availably and include baseline DDoS protections against spikes in traffic. The users will login in to the web application using social IdPs such as Google, and Amazon.
How can the design requirements be met?
Build an API with API Gateway and AWS Lambda, use Amazon S3 for hosting static web resources and create an Amazon CloudFront distribution with the S3 bucket as the origin. Use Amazon Cognito to provide user management authentication functions
## Footnote
CloudFront can then be used to cache the S3 assets for lower latency for the global user base. CloudFront also offers basic DDoS protections with AWS Shield standard offered for free for use with CloudFront.
461
A company is creating an account structure on AWS. There will be separate accounts for the production and testing environments. The Solutions Architect wishes to implement centralized control of security identities and permissions to access the environments.
Which solution is most appropriate for these requirements?
Create a separate AWS account for identities where IAM user accounts can be created. Create roles with appropriate permissions in the production and testing accounts. Add the identity account to the trust policies for the roles
462
An automotive company is using AWS CodeBuild for CI/CD pipelines where each CodeBuild project is directly mapped to an individual application. Many of these applications use large sets of marketing data which is hosted inside an Amazon S3 bucket.
This data is provided by files which are owned by another third-party agency. A few of these projects need the entire set of data while a few of them require just a subset of more relevant data.
As the number of CodeBuild projects grows, the company notices a significant increase in the time required for the pipeline to finish running. The company wants to optimize the pipeline and reduce the amount of time that the pipeline requires to finish running.
Which solution will meet these requirements?
Create an S3 bucket for the pipeline. Configure S3 caching for the CodeBuild projects that are in the pipeline. Update the build specifications of the CodeBuild projects. Add the data file directory to the cache definition
463
An eCommerce company runs a workload on AWS that includes a web and application tier running on Amazon EC2 and a database tier running on Amazon RDS MySQL. The business requires a cost-efficient disaster recovery solution for the application with an RTO of 5 minutes and an RPO of 1 hour. The solution should ensure the primary and DR sites have a minimum distance of 150 miles between them.
Which option could a Solutions Architect recommend to meet the company’s disaster recovery requirements?
Deploy a scaled-down version of the production environment in a separate AWS Region ensuring the minimum distance requirements are met. The DR environment should include one instance for the web tier and one instance for the application tier. Create another database instance and configure source-replica replication for MySQL. Configure Auto Scaling for the web and app tiers to they can scale based on load. Use Amazon Route 53 to switch traffic to the DR Region
464
A company which recently moved to AWS is trying to build a hybrid DNS solution. An AWS Direct Connect (DX) connection between the on-premises corporate network and an AWS Transit Gateway is established.
This solution will use an Amazon Route 53 private hosted zone for the domain internal.company.local for the resources stored within Amazon VPCs. The company has the following DNS resolution requirements:
· On-premises systems should be able to resolve and connect to internal.company.local.
· All VPCs should be able to resolve internal.company.local.
Which architecture should the company use to meet these requirements with the HIGHEST performance?
Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for internal.company.local that point to the inbound resolver
465
A finance organization runs a data processing application in an on-premises data center. The application processes input files that are uploaded by users upload through a web portal. A web server stores the uploaded files on a shared NFS storage appliance and messages the processing server over a message queue. The input files can take up to 1 hour to process and the number of files awaiting processing can be high during business hours and drops outside of business hours.
Which of the following is the MOST cost-effective migration recommendation?
Create an Amazon SQS queue. Configure the existing web server to publish to the new queue. Use Amazon EC2 instances in an EC2 Auto Scaling group to pull requests from the queue and process the files. Scale the EC2 instances based on the SQS queue length. Store the processed files in an Amazon S3 bucket
466
An application is being tested for deployment in a Development account. The application consists of an Amazon API Gateway, Amazon EC2 instances behind an Elastic Load Balancer and an Amazon DynamoDB table. The Developers wish to grant a testing team access to deploy the application several times for performing a variety of acceptance tests but don’t want to grant broad permissions to each user. The Developers currently deploy the application using an AWS CloudFormation template and a role that has permission to the APIs for the included services.
How can a Solutions Architect meet the requirements for granting restricted access to the testing team so they can run their tests?
Create an AWS Service Catalog product from the environment template and add a launch constraint to the product with the existing role. Give users in the testing team permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console
467
A legacy application consists of a series of batch scripts that coordinate multiple application components. Each application component processes data within a few seconds before passing it on to the next component. The application has become complex and difficult to update. A Solutions Architect plans to migrate the application to the AWS Cloud. The application should be refactored into serverless microservices and be fully coordinated using cloud-native services.
Which approach meets these requirements most cost-effectively?
Refactor the application onto AWS Lambda functions. Use AWS Step Functions to orchestrate the application
468
A company is reviewing its CI/CD practices for updating a critical web application that runs on Amazon ECS. The application manager requires that deployments happen as quickly as possible with a minimum of downtime. In the case of errors there must be an ability to quickly roll back. The company currently uses AWS CodeCommit to host the application source code and has configured an AWS CodeBuild project to build the application. The company also plans to use AWS CodePipeline to trigger builds from CodeCommit commits using the existing CodeBuild project.
What changes should be made to the CI/CD configuration to meet these requirements?
Create a pipeline in CodePipeline with a deploy stage that uses a blue/green deployment strategy. Monitor the application and if there are any issues trigger a manual rollback using CodeDeploy
469
A company runs an application on Amazon EC2 instances in an Amazon VPC and must access an external security analytics service that runs on an HTTPS REST API. The provider of the external API service can only grant access to a single source public IP address per customer.
Which configuration can be used to enable access to the API service using a single IP address without making modifications to the company’s application?
Launch the Amazon EC2 instances in a private subnet with an outbound route to a NAT gateway in a public subnet. Associate an Elastic IP address to the NAT gateway that can be whitelisted on the external API service
470
A company has created a management account and added several member accounts in an AWS Organization. The security team wishes to restrict access to a specific set of AWS services in the existing member accounts.
How can this requirement be implemented MOST efficiently?
Add the member accounts to a single organizational unit (OU). Create a service control policy (SCP) that denies access to the specific set of services and attach it to the OU
471
A business is transitioning its website from an on-premises setup to AWS, aiming to adopt a containerized microservice architecture for enhanced availability and cost efficiency. In line with the company's stringent security policies, which emphasize minimal privilege for network permissions and privileges, a solutions architect has already deployed the application on an Amazon ECS cluster.
To align with these security requirements post-deployment, what two actions should be taken?
- Set up the tasks using the awsvpc network mode for enhanced network isolation and control
- Attach security groups to the individual tasks and utilize IAM roles specifically designed for tasks to access other AWS resources
## Footnote
The awsvpc network mode provides each task with its own elastic network interface, IP address, and security group, offering better isolation and control compared to bridge mode. This aligns with best practices for security and network configuration in a microservices architecture
472
A company is planning to migrate 30 small applications to AWS. The applications run on a mixture of Node.js and Python across a cluster of virtual servers on-premises. The company must minimize costs and standardize on a single deployment methodology for all applications. The applications have various usage patterns but generally have a low number of concurrent users. The applications use an average usage of 1 GB of memory with up to 3 GB during peak processing periods which can last several hours.
What is the MOST cost effective solution for these requirements?
Migrate the applications to Docker containers on Amazon ECS. Create a separate ECS task and service for each application. Enable service Auto Scaling based on memory utilization and set the threshold to 75%. Monitor services and hosts by using Amazon CloudWatch
473
A company has recently established 15 Amazon VPCs within the us-east-1 AWS Region. The company has also established an AWS Direct Connect to the Region from their on-premises data center. The company requires full transitive peering between the VPCs and the on-premises data center.
Which combination of actions is required to implement these requirements with the LEAST complexity?
#ERROR!
474
A company uses AWS CodeCommit for source control and AWS CodePipeline for continuous integration. The pipeline has a build stage which uses an Amazon S3 bucket for artifacts. The company requires a new development pipeline for testing new features. The new pipeline should be isolated from the production pipeline and incorporate continuous testing for unit tests.
How can a Solutions Architect meet these requirements?
Create a separate pipeline in CodePipeline and trigger execution using CodeCommit branches. Use AWS CodeBuild for running unit tests and stage the artifacts in an S3 bucket in a separate testing account
475
An e-commerce company manages its flagship application on a load-balanced EC2 instance fleet for web hosting, database API services, and business logic. This tightly coupled architecture makes it inflexible for new feature additions while also making the architecture less scalable.
Which of the following options can be used to decouple the architecture, improve scalability and provide the ability to track the failed orders?
Configure Amazon S3 for hosting the web application while using AWS AppSync for database access services. Use Amazon Simple Queue Service (Amazon SQS) for queuing orders and AWS Lambda for business logic. Use Amazon SQS dead-letter queue for tracking and re-processing failed orders
## Footnote
AWS AppSync creates serverless GraphQL and Pub/Sub APIs that simplify application development through a single endpoint to securely query, update, or publish data
476
A financial services company has multiple AWS accounts hosting its portfolio of IT applications that serve the company's retail and enterprise customers. A CloudWatch Logs agent is installed on each of the EC2 instances running these IT applications. The company wants to aggregate all security events in a centralized AWS account dedicated to log storage. The centralized operations team at the company needs to perform near-real-time gathering and collating events across multiple AWS accounts.
As a Solutions Architect Professional, which solution would you suggest to meet these requirements?
Set up Kinesis Data Firehose in the logging account and then subscribe the delivery stream to CloudWatch Logs streams in each application AWS account via subscription filters. Persist the log data in an Amazon S3 bucket inside the logging AWS account
477
A leading pharmaceutical company has significant investments in running Oracle and PostgreSQL services on Amazon RDS which provide their scientists with near real-time analysis of millions of rows of manufacturing data generated by continuous manufacturing equipment with 1,600 data points per row. The business analytics team has been running ad-hoc queries on these databases to prepare daily reports for senior management. The engineering team has observed that the database performance takes a hit whenever these reports are run by the analytics team. To facilitate the business analytics reporting, the engineering team now wants to replicate this data with high availability and consolidate these databases into a petabyte-scale data warehouse by streaming data to Amazon Redshift.
As a Solutions Architect Professional, what would you recommend as the MOST resource-efficient solution that requires the LEAST amount of development time without the need to manage the underlying infrastructure?
Use AWS Database Migration Service to replicate the data from the databases into Amazon Redshift
## Footnote
The Amazon Redshift cluster must be in the same AWS account and the same AWS Region as the replication instance. During a database migration to Amazon Redshift, AWS DMS first moves data to an Amazon S3 bucket. When the files reside in an Amazon S3 bucket, AWS DMS then transfers them to the proper tables in the Amazon Redshift data warehouse. AWS DMS creates the S3 bucket in the same AWS Region as the Amazon Redshift database. The AWS DMS replication instance must be located in that same region.
478
A company manages a healthcare diagnostics application that writes thousands of lab images to a mounted NFS file system each night from 10 PM - 5 AM. The company wants to migrate this application from its on-premises data center to AWS Cloud over a private network. The company has already established an AWS Direct Connect connection to AWS to facilitate this migration. This application is slated to be moved to Amazon EC2 instances with the Elastic File System (Amazon EFS) file system as the storage service.
What represent the MOST optimal way of replicating all images to the cloud before the application is fully migrated to the cloud?
Deploy an AWS DataSync agent to an on-premises server that has access to the NFS file system. Send data over the Direct Connect connection to an AWS PrivateLink interface VPC endpoint for Amazon EFS by using a private VIF. Configure a DataSync scheduled task to send the images to the EFS file system every night
479
A team has recently created a secret using AWS Secrets Manager to access their private Amazon Relational Database Service (Amazon RDS) instance. When the team tried to rotate the AWS Secrets Manager secret in an Amazon Virtual Private Cloud (Amazon VPC), the operation failed. On analyzing the Amazon CloudWatch Logs, the team realized that the AWS Lambda task timed out.
Which of the following solutions needs to be implemented for rotating the secret successfully?
Configure an Amazon VPC interface endpoint to access your Secrets Manager Lambda rotation function and private Amazon Relational Database Service (Amazon RDS) instance
480
A company manages a stateful web application that persists data on a MySQL database. The application stack is hosted in the company's on-premises data center using a single server. The company is looking at increasing its market presence through promotions and campaigns. While the user experience has been good so far, the current application architecture will not support the growth that the company envisages. The company has hired you as an AWS Certified Solutions Architect Professional to migrate the current architecture to AWS which should continue to support SQL-based queries. The proposed solution should offer maximum reliability with better performance.
What would you recommend?
Set up database migration to Amazon Aurora MySQL. Deploy the application in an Auto Scaling group for Amazon EC2 instances that are fronted by an Application Load Balancer. Store sessions in an Amazon ElastiCache for Redis with replication group
481
A team uses an Amazon S3 bucket to store the client data. After updating the S3 bucket with a few file deletes and some new file additions, the team has just realized that these changes have not been propagated to the AWS Storage Gateway file share.
What is the underlying issue? Which method can be used to resolve it?
Storage Gateway doesn't automatically update the cache when you upload a file directly to Amazon S3. Perform a **RefreshCache** operation to see the changes on the file share
## Footnote
Storage Gateway updates the file share cache automatically when you write files to the cache locally using the file share. However, Storage Gateway doesn't automatically update the cache when you upload a file directly to Amazon S3. When you do this, you must perform a RefreshCache operation to see the changes on the file share. If you have more than one file share, then you must run the RefreshCache operation on each file share.
482
A retail company is introducing multiple business units as part of its expansion plans. To implement this change, the company will be building several new business-unit-specific workloads by leveraging a variety of AWS services. The company wants to track the expenses of each business unit and limit the spending to a pre-defined threshold. In addition, the solution should allow the security team to identify and respond to threats as quickly as possible for all the workloads across the business units. Also, workload accounts may need to be pulled off into a temporary holding area due to resource audit reasons.
Which of the following can be combined to build a solution for the given requirements?
#ERROR!
483
A company uses Elastic Load Balancing to distribute traffic across multiple Amazon EC2 instances. Auto Scaling groups start and stop Amazon EC2 machines based on the number of incoming requests. The company has recently started operations in a new AWS Region and is setting up an Application Load Balancer for its fleet of EC2 instances spread across two Availability Zones, with one instance as a target in Availability Zone X and four instances as targets in Availability Zone Y. The company is doing benchmarking for server performance in the new Region for the case when cross-zone load balancing is enabled compared to the case when cross-zone load balancing is disabled.
As a Solutions Architect Professional, which traffic distribution outcomes would you identify as correct?
With cross-zone load balancing enabled, one instance in Availability Zone X receives 20% traffic and four instances in Availability Zone Y receive 20% traffic each. With cross-zone load balancing disabled, one instance in Availability Zone X receives 50% traffic and four instances in Availability Zone Y receive 12.5% traffic each
484
A company uses Amazon FSx for Windows File Server with deployment type of Single-AZ 2 as its file storage service for its non-core functions. With a change in the company's policy that mandates high availability of data for all its functions, the company needs to change the existing configuration. The company also needs to monitor the file system activity as well as the end-user actions on the Amazon FSx file server.
Which solutions will you combine to implement these requirements?
#ERROR!
485
The security team at a company has put forth a requirement to track the external IP address when a customer or a third party uploads files to the Amazon Simple Storage Service (Amazon S3) bucket owned by the company.
How will you track the external IP address used for each upload?
#ERROR!
486
A company is migrating its two-tier legacy application (using MongoDB as a key-value database) from its on-premises data center to AWS. The company has mandated that the EC2 instances must be hosted in a private subnet with no internet access. In addition, all connectivity between the EC2 instance-hosted application and the database must be encrypted. The database must be able to scale to meet traffic spikes from any bursty or unpredictable workloads.
Which do you recommend?
Set up new Amazon DynamoDB tables for the application with on-demand capacity. Use a gateway VPC endpoint for DynamoDB so that the application can have a private and encrypted connection to the DynamoDB tables
487
Recently, an Amazon CloudFront distribution has been configured with an Amazon S3 bucket as the origin. However, users are getting an HTTP 307 Temporary Redirect response from Amazon S3.
What could be the reason for this behavior and how will you resolve the issue?
- When a new Amazon S3 bucket is created, it takes up to 24 hours before the bucket name propagates across all AWS Regions
- CloudFront by default, forwards the requests to the default S3 endpoint. Change the origin domain name of the distribution to include the Regional endpoint of the bucket
488
A company has its flagship application fronted by an Application Load Balancer that is targeting several EC2 Linux instances running in an Auto Scaling group in a private subnet. AWS Systems Manager Agent is installed on all the EC2 instances. The company recently released a new version of the application, however, some of the EC2 instances are now being marked as unhealthy and are being terminated, thereby causing the application to run at reduced capacity. You have been tasked to ascertain the root cause by analyzing Amazon CloudWatch logs that are collected from the application, but you find that the logs are inconclusive.
What option would you propose to get access to an EC2 instance to troubleshoot the issue?
Suspend the Auto Scaling group's Terminate process. Use Session Manager to log in to an instance that is marked as unhealthy and analyze the system logs to figure out the root cause
489
A company provides a web-based business-management platform for IT service companies across the globe to manage help desk, customer service, sales and marketing, and other critical business functions. More than 50,000 people use the company's platform, so the company must respond quickly to any reported problems. However, the company has issues with not having enough visibility into its systems to discover any issues. Multiple logs and monitoring systems are needed to understand the root cause of problems thereby taking hours to resolve. Even as the company is slowly moving towards serverless architecture using AWS Lambda/Amazon API Gateway/Amazon Elastic Container Service (Amazon ECS), the company wants to monitor the microservices and gain deeper insights into its serverless resources.
What will you recommend to address the given requirements?
Use AWS X-Ray to analyze the microservices applications through request tracing. Configure Amazon CloudWatch for monitoring containers, latency, web server requests, and incoming load-balancer requests and create CloudWatch alarms to send out notifications if system latency is increasing
