Quiz IT certification exam

Question 1

A company’s application is increasingly popular and experiencing latency because of high volume reads on the database server. The service has the following properties:

A highly available REST API hosted in one region using Application Load Balancer (ALB) with auto scaling. A MySQL database hosted on an Amazon EC2 instance in a single Availability Zone. The company wants to reduce latency, increase in-region database read performance, and have multi-region disaster recovery capabilities that can perform a live recovery automatically without any data or performance loss (HA/DR). Which deployment strategy will meet these requirements?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Use AWS CloudFormation StackSets to deploy the API layer in two regions. Migrate the database to an Amazon Aurora with MySQL database cluster with multiple read replicas in one region and a read replica in a different region than the source database cluster. Use Amazon Route 53 health checks to trigger a DNS failover to the standby region if the health checks to the primary load balancer fail. In the event of Route 53 failover, promote the cross-region database replica to be the master and build out new read replicas in the standby region.

Answer

Use Amazon ElastiCache for Redis Multi-AZ with an automatic failover to cache the database read queries. Use AWS OpsWorks to deploy the API layer, cache layer, and existing database layer in two regions. In the event of failure, use Amazon Route 53 health checks on the database to trigger a DNS failover to the standby region if the health checks in the primary region fail. Back up the MySQL database frequently, and in the event of a failure in an active region, copy the backup to the standby region and restore the standby database.

Answer

Use AWS CloudFormation StackSets to deploy the API layer in two regions. Add the database to an Auto Scaling group. Add a read replica to the database in the second region. Use Amazon Route 53 health checks on the database to trigger a DNS failover to the standby region if the health checks in the primary region fail. Promote the cross-region database replica to be the master and build out new read replicas in the standby region.

Answer

Use Amazon ElastiCache for Redis Multi-AZ with an automatic failover to cache the database read queries. Use AWS OpsWorks to deploy the API layer, cache layer, and existing database layer in two regions. Use Amazon Route 53 health checks on the ALB to trigger a DNS failover to the standby region if the health checks in the primary region fail. Back up the MySQL database frequently, and in the event of a failure in an active region, copy the backup to the standby region and restore the standby database.

Question 2

In Amazon ElastiCache, which of the following statements is correct?

Accepted Answer

You cannot use ElastiCache in a VPC that is configured for dedicated instance tenancy.

Answer

When you launch an ElastiCache cluster into an Amazon VPC private subnet, every cache node is assigned a public IP address within that subnet.

Answer

If your AWS account supports only the EC2-VPC platform, ElastiCache will never launch your cluster in a VPC.

Answer

ElastiCache is not fully integrated with Amazon Virtual Private Cloud (VPC).

Question 3

A company has an application written using an in-house software framework. The framework installation takes 30 minutes and is performed with a user data script. Company Developers deploy changes to the application frequently. The framework installation is becoming a bottleneck in this process.Which of the following would speed up this process?

Accepted Answer

Create a pipeline to parallelize the installation tasks and call this pipeline from a user data script.

Answer

Create a pipeline to build a custom AMI with the framework installed and use this AMI as a baseline for application deployments.

Answer

Employ a user data script to install the framework but compress the installation files to make them smaller.

Answer

Configure an AWS OpsWorks cookbook that installs the framework instead of employing user data. Use this cookbook as a base for all deployments.

Question 4

During a security audit of a Service team’s application, a Solutions Architect discovers that a username and password for an Amazon RDS database and a set of AWS IAM user credentials can be viewed in the AWS Lambda function code. The Lambda function uses the username and password to run queries on the database, and it uses the IAM credentials to call AWS services in a separate management account. The Solutions Architect is concerned that the credentials could grant inappropriate access to anyone who can view the Lambda code. The management account and the Service team’s account are in separate AWS Organizations organizational units (OUs).Which combination of changes should the Solutions Architect make to improve the solution’s security? (Choose two.)

Accepted Answer

Configure Lambda to use the stored database credentials in AWS Secrets Manager and enable automatic rotation.

Accepted Answer

Use an SCP on the management account’s OU to prevent IAM users from accessing resources in the Service team’s account.

Answer

Configure Lambda to assume a role in the management account with appropriate access to AWS.

Answer

Create a Lambda function to rotate the credentials every hour by deploying a new Lambda version with the updated credentials.

Answer

Enable AWS Shield Advanced on the management account to shield sensitive resources from unauthorized IAM access.

Question 5

In Amazon Cognito, your mobile app authenticates with the Identity Provider (IdP) using the provider's SDK. Once the end user is authenticated with the IdP, the OAuth or OpenID Connect token returned from the IdP is passed by your app to Amazon Cognito, which returns a new _____ for the user and a set of temporary, limited-privilege AWS credentials.

Accepted Answer

Cognito ID

Answer

Cognito Key Pair

Answer

Cognito API

Answer

Cognito SDK

Question 6

A large global company wants to migrate a stateless mission-critical application to AWS. The application is based on IBM WebSphere (application and integration middleware), IBM MQ (messaging middleware), and IBM DB2 (database software) on a z/OS operating system.How should the Solutions Architect migrate the application to AWS?

Accepted Answer

Re-host WebSphere-based applications on Amazon EC2 behind a load balancer with Auto Scaling. Re-platform the IBM MQ to an Amazon MQ. Re-platform z/OS-based DB2 to Amazon EC2-based DB2.

Answer

Re-host WebSphere-based applications on Amazon EC2 behind a load balancer with Auto Scaling. Re-platform the IBM MQ to an Amazon EC2-based MQ. Re-platform the z/OS-based DB2 to Amazon RDS DB2.

Answer

Orchestrate and deploy the application by using AWS Elastic Beanstalk. Re-platform the IBM MQ to Amazon SQS. Replatform z/OS-based DB2 to Amazon RDS DB2.

Answer

Use the AWS Server Migration Service to migrate the IBM WebSphere and IBM DB2 to an Amazon EC2-based solution. Re-platform the IBM MQ to an Amazon MQ.

Question 7

A company uses Amazon S3 to store documents that may only be accessible to an Amazon EC2 instance in a certain virtual private cloud (VPC). The company fears that a malicious insider with access to this instance could also set up an EC2 instance in another VPC to access these documents.Which of the following solutions will provide the required protection?

Accepted Answer

Use EC2 instance profiles and an S3 bucket policy to limit access to the role attached to the instance profile.

Answer

Use an S3 VPC endpoint and an S3 bucket policy to limit access to this VPC endpoint.

Answer

Use S3 client-side encryption and store the key in the instance metadata.

Answer

Use S3 server-side encryption and protect the key with an encryption context.

Question 8

When you put objects in Amazon S3, what is the indication that an object was successfully stored?

Accepted Answer

A HTTP 200 result code and MD5 checksum, taken together, indicate that the operation was successful.

Answer

Amazon S3 is engineered for 99.999999999% durability. Therefore there is no need to confirm that data was inserted.

Answer

A success code is inserted into the S3 object metadata.

Answer

Each S3 account has a special bucket named _s3_logs. Success codes are written to this bucket with a timestamp and checksum.

Question 9

You would like to create a mirror image of your production environment in another region for disaster recovery purposes. Which of the following AWS resources do not need to be recreated in the second region? (Choose two.)

Accepted Answer

Route 53 Record Sets

Accepted Answer

IAM Roles

Answer

Elastic IP Addresses (EIP)

Answer

EC2 Key Pairs

Answer

Launch configurations

Answer

Security Groups

Question 10

A customer has established an AWS Direct Connect connection to AWS. The link is up and routes are being advertised from the customer's end, however the customer is unable to connect from EC2 instances inside its VPC to servers residing in its datacenter.Which of the following options provide a viable solution to remedy this situation? (Choose two.)

Accepted Answer

Enable route propagation to the virtual pinnate gateway (VGW).

Accepted Answer

Modify the Instances VPC subnet route table by adding a route back to the customer's on-premises environment.

Answer

Add a route to the route table with an iPsec VPN connection as the target.

Answer

Enable route propagation to the customer gateway (CGW).

Answer

Modify the route table of all Instances using the 'route' command.

Question 11

A large company is running a popular web application. The application runs on several Amazon EC2 Linux instances in an Auto Scaling group in a private subnet. An Application Load Balancer is targeting the instances in the Auto Scaling group in the private subnet. AWS Systems Manager Session Manager is configured, and AWS Systems Manager Agent is running on all the EC2 instances. The company recently released a new version of the application. Some EC2 instances are now being marked as unhealthy and are being terminated. As a result, the application is running at reduced capacity. A solutions architect tries to determine the root cause by analyzing Amazon CloudWatch logs that are collected from the application, but the logs are inconclusive. How should the solutions architect gain access to an EC2 instance to troubleshoot the issue?

Accepted Answer

Suspend the Auto Scaling group’s HealthCheck scaling process. Use Session Manager to log in to an instance that is marked as unhealthy.

Answer

Enable EC2 instance termination protection. Use Session Manager to log in to an instance that is marked as unhealthy.

Answer

Set the termination policy to OldestInstance on the Auto Scaling group. Use Session Manager to log in to an instance that is marked an unhealthy.

Answer

Suspend the Auto Scaling group’s Terminate process. Use Session Manager to log in to an instance that is marked as unhealthy.

Question 12

A company has developed a web application that runs on Amazon EC2 instances in one AWS Region. The company has taken on new business in other countries and must deploy its application into other regions to meet low-latency requirements for its users. The regions can be segregated, and an application running in one region does not need to communicate with instances in other regions. How should the company’s Solutions Architect automate the deployment of the application so that it can be MOST efficiently deployed into multiple regions?

Accepted Answer

Write a CloudFormation template describing the application’s infrastructure in the Resources section. Use a CloudFormation stack set from an administrator account to launch stack instances that deploy the application to other regions.

Answer

Write a bash script that uses the AWS CLI to query the current state in one region and output a JSON representation. Pass the JSON representation to the AWS CLI, specifying the --region parameter to deploy the application to other regions.

Answer

Write a bash script that uses the AWS CLI to query the current state in one region and output an AWS CloudFormation template. Create a CloudFormation stack from the template by using the AWS CLI, specifying the --region parameter to deploy the application to other regions.

Answer

Write a CloudFormation template describing the application’s infrastructure in the resources section. Create a CloudFormation stack from the template by using the AWS CLI, specify multiple regions using the --regions parameter to deploy the application.

Question 13

Which of the following is NOT true of the DynamoDB Console?

Accepted Answer

It allows you to add local secondary indexes to existing tables.

Answer

It allows you to query a table.

Answer

It allows you to set up alarms to monitor your table's capacity usage.

Answer

It allows you to view items stored in a tables, add, update, and delete items.

Question 14

A security engineer determined that an existing application retrieves credentials to an Amazon RDS for MySQL database from an encrypted file in Amazon S3. For the next version of the application, the security engineer wants to implement the following application design changes to improve security:The database must use strong, randomly generated passwords stored in a secure AWS managed service.The application resources must be deployed through AWS CloudFormation. The application must rotate credentials for the database every 90 days. A solutions architect will generate a CloudFormation template to deploy the application.Which resources specified in the CloudFormation template will meet the security engineer’s requirements with the LEAST amount of operational overhead?

Accepted Answer

Generate the database password as a secret resource using AWS Secrets Manager. Create an AWS Lambda function resource to rotate the database password. Create an Amazon EventBridge scheduled rule resource to trigger the Lambda function password rotation every 90 days.

Answer

Generate the database password as a secret resource using AWS Secrets Manager. Create an AWS Lambda function resource to rotate the database password. Specify a Secrets Manager RotationSchedule resource to rotate the database password every 90 days.

Answer

Generate the database password as a SecureString parameter type using AWS Systems Manager Parameter Store. Create an AWS Lambda function resource to rotate the database password. Specify a Parameter Store RotationSchedule resource to rotate the database password every 90 days.

Answer

Generate the database password as a SecureString parameter type using AWS Systems Manager Parameter Store. Specify an AWS AppSync DataSource resource to automatically rotate the database password every 90 days.

Question 15

An organization is undergoing a security audit. The auditor wants to view the AWS VPC configurations as the organization has hosted all the applications in the AWS VPC. The auditor is from a remote place and wants to have access to AWS to view all the VPC records.How can the organization meet the expectations of the auditor without compromising on the security of their AWS infrastructure?

Accepted Answer

Create an IAM user who will have read only access to the AWS VPC and share those credentials with the auditor.

Answer

The organization should not accept the request as sharing the credentials means compromising on security.

Answer

Create an IAM role which will have read only access to all EC2 services including VPC and assign that role to the auditor.

Answer

The organization should create an IAM user with VPC full access but set a condition that will not allow to modify anything if the request is from any IP other than the organization's data center.

Question 16

An organization hosts an app on EC2 instances which multiple developers need access to in order to perform updates. The organization plans to implement some security best practices related to instance access. Which one of the following recommendations will not help improve its security in this way?

Accepted Answer

Create an IAM policy allowing only IAM users to connect to the EC2 instances with their own SSH key.

Answer

Disable the password based login for all the users. All the users should use their own keys to connect with the instance securely.

Answer

Create a procedure to revoke the access rights of the individual user when they are not required to connect to EC2 instance anymore for the purpose of application configuration.

Answer

Apply the latest patch of OS and always keep it updated.

Question 17

<img alt="Amazon SAP-C01 image Question 497 6239 09162024005850000000"   width="376" height="333" src="https://examgecko.com/getfile/0bc603f7-1b96-4713-a617-446a727a9cb2">Refer to the architecture diagram above of a batch processing solution using Simple Queue Service (SQS) to set up a message queue between EC2 instances which are used as batch processors Cloud Watch monitors the number of Job requests (queued messages) and an Auto Scaling group adds or deletes batch servers automatically based on parameters set in Cloud Watch alarms. You can use this architecture to implement which of the following features in a cost effective and efficient manner?

Accepted Answer

Coordinate number of EC2 instances with number of job requests automatically thus Improving cost effectiveness.

Answer

Reduce the overall lime for executing jobs through parallel processing by allowing a busy EC2 instance that receives a message to pass it to the next instance in a daisy-chain setup.

Answer

Implement fault tolerance against EC2 instance failure since messages would remain in SQS and worn can continue with recovery of EC2 instances implement fault tolerance against SQS failure by backing up messages to S3.

Answer

Implement message passing between EC2 instances within a batch by exchanging messages through SQS.

Answer

Handle high priority jobs before lower priority jobs by assigning a priority metadata field to SQS messages.

Question 18

Your customer wishes to deploy an enterprise application to AWS, which will consist of several web servers, several application servers and a small (50GB) Oracle database. Information is stored, both in the database and the file systems of the various servers. The backup system must support database recovery whole server and whole disk restores, and individual file restores with a recovery time of no more than two hours. They have chosen to use RDS Oracle as the database.Which backup architecture will meet these requirements?

Accepted Answer

Backup RDS using automated daily DB backups. Backup the EC2 instances using AMIs and supplement with file-level backup to S3 using traditional enterprise backup software to provide file level restore.

Answer

Backup RDS using a Multi-AZ Deployment. Backup the EC2 instances using Amis, and supplement by copying file system data to S3 to provide file level restore.

Answer

Backup RDS using automated daily DB backups. Backup the EC2 instances using EBS snapshots and supplement with file-level backups to Amazon Glacier using traditional enterprise backup software to provide file level restore.

Answer

Backup RDS database to S3 using Oracle RMAN. Backup the EC2 instances using Amis, and supplement with EBS snapshots for individual volume restore.

Question 19

You have written a CloudFormation template that creates 1 Elastic Load Balancer fronting 2 EC2 Instances. Which section of the template should you edit so that the DNS of the load balancer is returned upon creation of the stack?

Accepted Answer

Outputs

Answer

Parameters

Answer

Mappings

Answer

Resources

Question 20

A finance company is running its business-critical application on current-generation Linux EC2 instances. The application includes a self-managed MySQL database performing heavy I/O operations. The application is working fine to handle a moderate amount of traffic during the month. However, it slows down during the final three days of each month due to month-end reporting, even though the company is using Elastic Load Balancers and Auto Scaling within its infrastructure to meet the increased demand.Which of the following actions would allow the database to handle the month-end load with the LEAST impact on performance?

Accepted Answer

Replacing all existing Amazon EBS volumes with new PIOPS volumes that have the maximum available storage size and I/O per second by taking snapshots before the end of the month and reverting back afterwards.

Answer

Pre-warming Elastic Load Balancers, using a bigger instance type, changing all Amazon EBS volumes to GP2 volumes.

Answer

Performing a one-time migration of the database cluster to Amazon RDS, and creating several additional read replicas to handle the load during end of month.

Answer

Using Amazon CloudWatch with AWS Lambda to change the type, size, or IOPS of Amazon EBS volumes in the cluster based on a specific CloudWatch metric.

Question 21

Does an AWS Direct Connect location provide access to Amazon Web Services in the region it is associated with as well as access to other US regions?

Accepted Answer

Yes, it provides access.

Answer

No, it provides access only to the region it is associated with.

Answer

No, it provides access only to the US regions other than the region it is associated with.

Answer

Yes, it provides access but only when there's just one Availability Zone in the region.

Question 22

A financial services company logs personally identifiable information to its application logs stored in Amazon S3. Due to regulatory compliance requirements, the log files must be encrypted at rest. The security team has mandated that the company’s on-premises hardware security modules (HSMs) be used to generate the CMK material.Which steps should the solutions architect take to meet these requirements?

Accepted Answer

Create a new CMK in AWS KMS with AWS-provided key material and an origin of AWS_KMS. Disable this CMK, and overwrite the key material with the key material from the on-premises HSM using the public key and import token provided by AWS. Re-enable the CMK. Enable automatic key rotation on the CMK with a duration of 1 year. Configure a bucket policy on the logging bucket that disallows uploads of non-encrypted data and requires that the encryption source be AWS KMS.

Answer

Create an AWS CloudHSM cluster. Create a new CMK in AWS KMS using AWS_CloudHSM as the source for the key material and an origin of AWS_CLOUDHSM. Enable automatic key rotation on the CMK with a duration of 1 year. Configure a bucket policy on the logging bucket that disallows uploads of unencrypted data and requires that the encryption source be AWS KMS.

Answer

Provision an AWS Direct Connect connection, ensuring there is no overlap of the RFC 1918 address space between onpremises hardware and the VPCs. Configure an AWS bucket policy on the logging bucket that requires all objects to be encrypted. Configure the logging application to query the on-premises HSMs from the AWS environment for the encryption key material, and create a unique CMK for each logging event.

Answer

Create a CMK in AWS KMS with no key material and an origin of EXTERNAL. Import the key material generated from the on-premises HSMs into the CMK using the public key and import token provided by AWS. Configure a bucket policy on the logging bucket that disallows uploads of non-encrypted data and requires that the encryption source be AWS KMS.

Question 23

A scientific company needs to process text and image data from an Amazon S3 bucket. The data is collected from several radar stations during a live, time-critical phase of a deep space mission. The radar stations upload the data to the source S3 bucket. The data is prefixed by radar station identification number.The company created a destination S3 bucket in a second account. Data must be copied from the source S3 bucket to the destination S3 bucket to meet a compliance objective. The replication occurs through the use of an S3 replication rule to cover all objects in the source S3 bucket.One specific radar station is identified as having the most accurate data. Data replication at this radar station must be monitored for completion within 30 minutes after the radar station uploads the objects to the source S3 bucket. What should a solutions architect do to meet these requirements?

Accepted Answer

Set up an AWS DataSync agent to replicate the prefixed data from the source S3 bucket to the destination S3 bucket. Select to use all available bandwidth on the task, and monitor the task to ensure that it is in the TRANSFERRING status. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to trigger an alert if this status changes.

Answer

In the second account, create another S3 bucket to receive data from the radar station with the most accurate data. Set up a new replication rule for this new S3 bucket to separate the replication from the other radar stations. Monitor the maximum replication time to the destination. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to trigger an alert when the time exceeds the desired threshold.

Answer

Enable Amazon S3 Transfer Acceleration on the source S3 bucket, and configure the radar station with the most accurate data to use the new endpoint. Monitor the S3 destination bucket’s TotalRequestLatency metric. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to trigger an alert if this status changes.

Answer

Create a new S3 replication rule on the source S3 bucket that filters for the keys that use the prefix of the radar station with the most accurate data. Enable S3 Replication Time Control (S3 RTC). Monitor the maximum replication time to the destination. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to trigger an alert when the time exceeds the desired threshold.

Question 24

A financial company is building a system to generate monthly, immutable bank account statements for its users. Statements are stored in Amazon S3. Users should have immediate access to their monthly statements for up to 2 years. Some users access their statements frequently, whereas others rarely access their statements. The company’s security and compliance policy requires that the statements be retained for at least 7 years. What is the MOST cost-effective solution to meet the company’s needs?

Accepted Answer

Create an S3 bucket with versioning disabled. Store statements in S3 One Zone-Infrequent Access (S3 One Zone-IA). Define an S3 Lifecycle policy to move the data to S3 Glacier Deep Archive after 2 years. Attach an S3 Glacier Vault Lock policy with deny delete permissions for archives less than 7 years old.

Answer

Create an S3 bucket with Object Lock disabled. Store statements in S3 Standard. Define an S3 Lifecycle policy to transition the data to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days. Define another S3 Lifecycle policy to move the data to S3 Glacier Deep Archive after 2 years. Attach an S3 Glacier Vault Lock policy with deny delete permissions for archives less than 7 years old.

Answer

Create an S3 bucket with versioning enabled. Store statements in S3 Intelligent-Tiering. Use same-Region replication to replicate objects to a backup S3 bucket. Define an S3 Lifecycle policy for the backup S3 bucket to move the data to S3 Glacier. Attach an S3 Glacier Vault Lock policy with deny delete permissions for archives less than 7 years old.

Answer

Create an S3 bucket with Object Lock enabled. Store statements in S3 Intelligent-Tiering. Enable compliance mode with a default retention period of 2 years. Define an S3 Lifecycle policy to move the data to S3 Glacier after 2 years. Attach an S3 Glacier Vault Lock policy with deny delete permissions for archives less than 7 years old.

Question 25

In order for a table write to succeed, the provisioned throughput settings for the table and global secondary indexes, in DynamoDB, must have__________; otherwise, the write to the table will be throttled.

Accepted Answer

enough write capacity to accommodate the write

Answer

no additional write cost for the index

Answer

100 bytes of overhead per index item

Answer

the size less than or equal to 1 KB

Question 26

You have set up Auto Scaling to automatically scale in. Consequently, you must decide which instances Auto Scaling should end first. What should you use to configure this?

Accepted Answer

A termination policy

Answer

An Elastic Load Balancer

Answer

An IAM role

Answer

Another scaling group

Question 27

A company is having issues with a newly deployed serverless infrastructure that uses Amazon API Gateway, Amazon Lambda, and Amazon DynamoDB. In a steady state, the application performs as expected. However, during peak load, tens of thousands of simultaneous invocations are needed and user requests fail multiple times before succeeding. The company has checked the logs for each component, focusing specifically on Amazon CloudWatch Logs for Lambda. There are no errors logged by the services or applications. What might cause this problem?

Accepted Answer

The throttle limit set on API Gateway is very low. During peak load, the additional requests are not making their way through to Lambda.

Answer

Lambda has very low memory assigned, which causes the function to fail at peak load.

Answer

Lambda is in a subnet that uses a NAT gateway to reach out of the internet, and the function instance does not have sufficient Amazon EC2 resources in the VPC to scale with the load.

Answer

DynamoDB is set up in an auto scaling mode. During peak load, DynamoDB adjusts capacity and throughput behind the scenes, which is causing the temporary downtime. Once the scaling completes, the retries go through successfully.

Question 28

Will you be able to access EC2 snapshots using the regular Amazon S3 APIs?

Accepted Answer

No, snapshots are only available through the Amazon EC2 APIs.

Answer

Yes, you will be able to access using S3 APIs if you have chosen the snapshot to be stored in S3.

Answer

No, snapshots are only available through the Amazon EBS APIs.

Answer

Yes, you will be able to access them using S3 APIs as all snapshots are stored in S3.

Question 29

Does Amazon RDS API provide actions to modify DB instances inside a VPC and associate them with DB Security Groups?

Accepted Answer

Yes

Answer

Yes, Amazon does this but only for MySQL RDS.

Answer

No

Answer

Yes, Amazon does this but only for Oracle RDS.

Question 30

Your company hosts a social media site supporting users in multiple countries. You have been asked to provide a highly available design tor the application that leverages multiple regions tor the most recently accessed content and latency sensitive portions of the wet) site The most latency sensitive component of the application involves reading user preferences to support web site personalization and ad selection. In addition to running your application in multiple regions, which option will support this application’s requirements?

Accepted Answer

Serve user content from S3. CloudFront and use Route53 latency-based routing between ELBs in each region Retrieve user preferences from a local DynamoDB table in each region and leverage SQS to capture changes to user preferences with SOS workers for propagating updates to each table.

Answer

Use the S3 Copy API to copy recently accessed content to multiple regions and serve user content from S3. CloudFront with dynamic content and an ELB in each region Retrieve user preferences from an ElasticCache cluster in each region and leverage SNS notifications to propagate user preference changes to a worker node in each region.

Answer

Use the S3 Copy API to copy recently accessed content to multiple regions and serve user content from S3 CloudFront and Route53 latency-based routing Between ELBs In each region Retrieve user preferences from a DynamoDB table and leverage SQS to capture changes to user preferences with SOS workers for propagating DynamoDB updates.

Answer

Serve user content from S3. CloudFront with dynamic content, and an ELB in each region Retrieve user preferences from an ElastiCache cluster in each region and leverage Simple Workflow (SWF) to manage the propagation of user preferences from a centralized OB to each ElastiCache cluster.

Question 31

A user is sending a custom metric to CloudWatch. If the call to the CloudWatch APIs has different dimensions, but the same metric name, how will CloudWatch treat all the requests?

Accepted Answer

It will treat each unique combination of dimensions as a separate metric.

Answer

It will reject the request as there cannot be a separate dimension for a single metric.

Answer

It will group all the calls into a single call.

Answer

It will overwrite the previous dimension data with the new dimension data.

Question 32

A user is planning to host a Highly Available system on the AWS VPC. Which of the below mentioned statements is helpful in this scenario?

Accepted Answer

Create VPC subnets in two separate availability zones and launch instances in different subnets.

Answer

Create VPC with only one public subnet and launch instances in different AZs using that subnet.

Answer

Create two VPCs in two separate zones and setup failover with ELB such that if one VPC fails it will divert traffic to another VPC.

Answer

Create VPC with only one private subnet and launch instances in different AZs using that subnet.

Question 33

A company’s main intranet page has experienced degraded response times as its user base has increased although there are no reports of users seeing error pages. The application uses Amazon DynamoDB in read-only mode.Amazon DynamoDB latency metrics for successful requests have been in a steady state even during times when users have reported degradation. The Development team has correlated the issue to ProvisionedThrough put Exceeded exceptions in the application logs when doing Scan and read operations The team also identified an access pattern of steady spikes of read activity on a distributed set of individual data items.The Chief Technology Officer wants to improve the user experience.Which solutions will meet these requirements with the LEAST amount of changes to the application? (Choose two.)

Accepted Answer

Change the data model of the DynamoDB tables to ensure that all Scan and read operations meet DynamoDB best practices of uniform data access, reaching the full request throughput provisioned for the DynamoDB tables.

Accepted Answer

Remove error retries and exponential backoffs in the application code to handle throttling errors.

Answer

Enable DynamoDB Auto Scaling to manage the throughput capacity as table traffic increases. Set the upper and lower limits to control costs and set a target utilization given the peak usage and how quickly the traffic changes.

Answer

Provision Amazon ElastiCache for Redis with cluster mode enabled. The cluster should be provisioned with enough shards to spread the application load and provision at least one read replica node for each shard.

Answer

Implement the DynamoDB Accelerator (DAX) client and provision a DAX cluster with the appropriate node types to sustain the application load. Tune the item and query cache configuration for an optimal user experience.

Question 34

A company has several Amazon EC2 instances to both public and private subnets within a VPC that is not connected to the corporate network. A security group associated with the EC2 instances allows the company to use the Windows remote desktop protocol (RDP) over the internet to access the instances. The security team has noticed connection attempts from unknown sources. The company wants to implement a more secure solution to access the EC2 instances. Which strategy should a solutions architect implement?

Accepted Answer

Deploy a Linux bastion host on the corporate network that has access to all instances in the VPC.

Answer

Deploy AWS Systems Manager Agent on the EC2 instances. Access the EC2 instances using Session Manager restricting access to users with permission.

Answer

Deploy a Linux bastion host with an Elastic IP address in the public subnet. Allow access to the bastion host from 0.0.0.0/0.

Answer

Establish a Site-to-Site VPN connecting the corporate network to the VPC. Update the security groups to allow access from the corporate network only.

Question 35

A company needs to establish a connection from its on-premises data center to AWS. The company needs to connect all of its VPCs that are located in different AWS Regions with transitive routing capabilities between VPC networks. The company also must reduce network outbound traffic costs, increase bandwidth throughput, and provide a consistent network experience for end users. Which solution will meet these requirements?

Accepted Answer

Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC. Create VPC peering connections that initiate from the central VPC to all other VPCs.

Answer

Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.

Answer

Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPUse a transit gateway with dynamic routing. Connect the transit gateway to all other VPCs.

Answer

Create an AWS Direct Connect connection between the on-premises data center and AWS. Establish an AWS Site-to- Site VPN connection between all VPCs in each Region. Create VPC peering connections that initiate from the central VPC to all other VPCs.

Question 36

You create a VPN connection, and your VPN device supports Border Gateway Protocol (BGP).Which of the following should be specified to configure the VPN connection?

Accepted Answer

Dynamic routing

Answer

Classless routing

Answer

Classfull routing

Answer

Static routing

Question 37

A solutions architect has implemented a SAML 2.0 federated identity solution with their company’s on-premises identity provider (IdP) to authenticate users’ access to the AWS environment. When the solutions architect tests authentication through the federated identity web portal, access to the AWS environment is granted. However, when test users attempt to authenticate through the federated identity web portal, they are not able to access the AWS environment. Which items should the solutions architect check to ensure identity federation is properly configured? (Choose three.)

Accepted Answer

The web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML provider, the ARN of the IAM role, and the SAML assertion from IdR.

Accepted Answer

The on-premises IdP’s DNS hostname is reachable from the AWS environment VPCs.

Accepted Answer

The company’s IdP defines SAML assertions that properly map users or groups in the company to IAM roles with appropriate permissions.

Answer

The IAM user’s permissions policy has allowed the use of SAML federation for that user.

Answer

The IAM roles created for the federated users’ or federated groups’ trust policy have set the SAML provider as the principal.

Answer

Test users are not in the AWSFederatedUsers group in the company’s IdR.

Question 38

An organization is setting up a multi-site solution where the application runs on premise as well as on AWS to achieve the minimum recovery time objective(RTO). Which of the below mentioned configurations will not meet the requirements of the multi-site solution scenario?

Accepted Answer

Setup a weighted DNS service like Route 53 to route traffic across sites.

Answer

Configure data replication based on RTO.

Answer

Keep an application running on premise as well as in AWS with full capacity.

Answer

Setup a single DB instance which will be accessed by both sites.

Question 39

An organization is trying to setup a VPC with Auto Scaling. Which configuration steps below is not required to setup AWS VPC with Auto Scaling?

Accepted Answer

Configure the Auto Scaling Launch configuration with multiple subnets of the VPC to enable the Multi AZ feature.

Answer

Configure the Auto Scaling group with the VPC ID in which instances will be launched.

Answer

Configure the Auto Scaling Launch configuration which does not allow assigning a public IP to instances.

Answer

Configure the Auto Scaling Launch configuration with the VPC security group.

Question 40

A travel company built a web application that uses Amazon Simple Email Service (Amazon SES) to send email notifications to users. The company needs to enable logging to help troubleshoot email delivery issues. The company also needs the ability to do searches that are based on recipient, subject, and time sent.Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Create an Amazon SES configuration set with Amazon Kinesis Data Firehose as the destination. Choose to send logs to an Amazon S3 bucket.

Answer

Enable AWS CloudTrail logging. Specify an Amazon S3 bucket as the destination for the logs.

Answer

Use Amazon Athena to query the logs in the Amazon S3 bucket for recipient, subject, and time sent.

Answer

Create an Amazon CloudWatch log group. Configure Amazon SES to send logs to the log group.

Answer

Use Amazon Athena to query the logs in Amazon CloudWatch for recipient, subject, and time sent.

Amazon SAP-C01 Practice Test 13

Amazon SAP-C01 Practice Tests