Quiz IT certification exam

Question 1

Your company policies require encryption of sensitive data at rest. You are considering the possible options for protecting data while storing it at rest on an EBS data volume, attached to an EC2 instance. Which of these options would allow you to encrypt your data at rest? (Choose three.)

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Implement third party volume encryption tools

Accepted Answer

Encrypt data inside your applications before storing it on EBS

Accepted Answer

Encrypt data using native data encryption drivers at the file system level

Answer

Implement SSL/TLS for all services running on the server

Answer

Do nothing as EBS volumes are encrypted by default

Question 2

What does elasticity mean to AWS?

Accepted Answer

The ability to scale computing resources up and down easily, with minimal friction.

Answer

The ability to scale computing resources up easily, with minimal friction and down with latency.

Answer

The ability to provision cloud computing resources in expectation of future demand.

Answer

The ability to recover from business continuity events with minimal friction.

Question 3

A company has used infrastructure as code (IaC) to provision a set of two Amazon EC2 instances. The instances have remained the same for several years. The company’s business has grown rapidly in the past few months. In response the company’s operations team has implemented an Auto Scaling group to manage the sudden increases in traffic. Company policy requires a monthly installation of security updates on all operating systems that are running.The most recent security update required a reboot. As a result, the Auto Scaling group terminated the instances and replaced them with new, unpatched instances. Which combination of steps should a solutions architect recommend to avoid a recurrence of this issue? (Choose two.)

Accepted Answer

Modify the Auto Scaling group by setting the Update policy to target the oldest launch configuration for replacement.

Accepted Answer

Create an Elastic Load Balancer in front of the Auto Scaling group. Configure monitoring to ensure that target group health checks return healthy after the Auto Scaling group replaces the terminated instances.

Answer

Create a new Auto Scaling group before the next patch maintenance. During the maintenance window, patch both groups and reboot the instances.

Answer

Create automation scripts to patch an AMI, update the launch configuration, and invoke an Auto Scaling instance refresh.

Answer

Create an Elastic Load Balancer in front of the Auto Scaling group. Configure termination protection on the instances.

Question 4

A solutions architect must analyze a company’s Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes to determine whether the company is using resources efficiently. The company is running several large, highmemory EC2 instances to host database clusters that are deployed in active/passive configurations. The utilization of these EC2 instances varies by the applications that use the databases, and the company has not identified a pattern. The solutions architect must analyze the environment and take action based on the findings.Which solution meets these requirements MOST cost-effectively?

Accepted Answer

Create a dashboard by using AWS Systems Manager OpsCenter. Configure visualizations for Amazon CloudWatch metrics that are associated with the EC2 instances and their EBS volumes. Review the dashboard periodically, and identify usage patterns. Rightsize the EC2 instances based on the peaks in the metrics.

Answer

Turn on Amazon CloudWatch detailed monitoring for the EC2 instances and their EBS volumes. Create and review a dashboard that is based on the metrics. Identify usage patterns. Rightsize the EC2 instances based on the peaks in the metrics.

Answer

Install the Amazon CloudWatch agent on each of the EC2 instances. Turn on AWS Compute Optimizer, and let it run for at least 12 hours. Review the recommendations from Compute Optimizer, and rightsize the EC2 instances as directed.

Answer

Sign up for the AWS Enterprise Support plan. Turn on AWS Trusted Advisor. Wait 12 hours. Review the recommendations from Trusted Advisor, and rightsize the EC2 instances as directed.

Question 5

A company is using an on-premises Active Directory service for user authentication. The company wants to use the same authentication service to sign in to the company’s AWS accounts, which are using AWS Organizations. AWS Site-to- Site VPN connectivity already exists between the on-premises environment and all the company’s AWS accounts. The company’s security policy requires conditional access to the accounts based on user groups and roles. User identities must be managed in a single location. Which solution will meet these requirements?

Accepted Answer

Configure AWS Single Sign-On (AWS SSO) by using AWS SSO as an identity source. Enable automatic provisioning by using the System for Cross-domain Identity Management (SCIM) v2.0 protocol. Grant access to the AWS accounts by using AWS SSO permission sets.

Answer

Configure AWS Single Sign-On (AWS SSO) to connect to Active Directory by using SAML 2.0. Enable automatic provisioning by using the System for Cross-domain Identity Management (SCIM) v2.0 protocol. Grant access to the AWS accounts by using attribute-based access controls (ABACs).

Answer

In one of the company’s AWS accounts, configure AWS Identity and Access Management (IAM) to use a SAML 2.0 identity provider. Provision IAM users that are mapped to the federated users. Grant access that corresponds to appropriate groups in Active Directory. Grant access to the required AWS accounts by using cross-account IAM users.

Answer

In one of the company’s AWS accounts, configure AWS Identity and Access Management (IAM) to use an OpenID Connect (OIDC) identity provider. Provision IAM roles that grant access to the AWS account for the federated users that correspond to appropriate groups in Active Directory. Grant access to the required AWS accounts by using cross-account IAM roles.

Question 6

After your Lambda function has been running for some time, you need to look at some metrics to ascertain how your function is performing and decide to use the AWS CLI to do this. Which of the following commands must be used to access these metrics using the AWS CLI?

Accepted Answer

list-metrics and get-metric-statistics

Answer

mon-list-metrics and mon-get-stats

Answer

ListMetrics and GetMetricStatistics

Answer

list-metrics and mon-get-stats

Question 7

A company built an ecommerce website on AWS using a three-tier web architecture. The application is Java-based and composed of an Amazon CloudFront distribution, an Apache web server layer of Amazon EC2 instances in an Auto Scaling group, and a backend Amazon Aurora MySQL database.Last month, during a promotional sales event, users reported errors and timeouts while adding items to their shopping carts.The operations team recovered the logs created by the web servers and reviewed Aurora DB cluster performance metrics.Some of the web servers were terminated before logs could be collected and the Aurora metrics were not sufficient for query performance analysis. Which combination of steps must the solutions architect take to improve application performance visibility during peak traffic events? (Choose three.)

Accepted Answer

Implement the AWS X-Ray SDK to trace incoming HTTP requests on the EC2 instances and implement tracing of SQLqueries with the X-Ray SDK for Java.

Accepted Answer

Configure the Aurora MySQL DB cluster to stream slow query and error logs to Amazon Kinesis

Accepted Answer

Enable and configure AWS CloudTrail to collect and analyze application activity from Amazon EC2 and Aurora.

Answer

Configure the Aurora MySQL DB cluster to publish slow query and error logs to Amazon CloudWatch Logs.

Answer

Install and configure an Amazon CloudWatch Logs agent on the EC2 instances to send the Apache logs to CloudWatch Logs.

Answer

Enable Aurora MySQL DB cluster performance benchmarking and publish the stream to AWS X-Ray.

Question 8

When using Numeric Conditions within IAM, short versions of the available comparators can be used instead of the more verbose versions. Which of the following is the short version of the Numeric Condition "NumericLessThanEquals"?

Accepted Answer

numlteq

Answer

numlteql

Answer

numltequals

Answer

numeql

Question 9

A company wants to move a web application to AWS. The application stores session information locally on each web server, which will make auto scaling difficult. As part of the migration, the application will be rewritten to decouple the session data from the web servers. The company requires low latency, scalability, and availability.Which service will meet the requirements for storing the session information in the MOST cost-effective way?

Accepted Answer

Amazon ElastiCache with the Redis engine

Answer

Amazon ElastiCache with the Memcached engine

Answer

Amazon S3

Answer

Amazon RDS MySQL

Question 10

A Solutions Architect must migrate an existing on-premises web application with 70 TB of static files supporting a public open-data initiative. The Architect wants to upgrade to the latest version of the host operating system as part of the migration effort.Which is the FASTEST and MOST cost-effective way to perform the migration?

Accepted Answer

Re-platform the server to Amazon EC2, and use AWS Snowball to transfer the static data to Amazon S3.

Answer

Run a physical-to-virtual conversion on the application server. Transfer the server image over the internet, and transfer the static data to Amazon S3.

Answer

Run a physical-to-virtual conversion on the application server. Transfer the server image over AWS Direct Connect, and transfer the static data to Amazon S3.

Answer

Re-platform the server by using the AWS Server Migration Service to move the code and data to a new Amazon EC2 instance.

Question 11

A company provides auction services for artwork and has users across North America and Europe. The company hosts its application in Amazon EC2 instances in the us-east-1 Region. Artists upload photos of their work as large-size, highresolution image files from their mobile phones to a centralized Amazon S3 bucket created in the us-east-1 Region. The users in Europe are reporting slow performance for their image uploads. How can a solutions architect improve the performance of the image upload process?

Accepted Answer

Configure the buckets to use S3 Transfer Acceleration.

Answer

Redeploy the application to use S3 multipart uploads.

Answer

Create an Amazon CloudFront distribution and point to the application as a custom origin.

Answer

Create an Auto Scaling group for the EC2 instances and create a scaling policy.

Question 12

True or false: In a CloudFormation template, you can reuse the same logical ID several times to reference the resources in other parts of the template.

Accepted Answer

False, a logical ID must be unique within the template.

Answer

True, a logical ID can be used several times to reference the resources in other parts of the template.

Answer

False, you can mention a resource only once and you cannot reference it in other parts of a template.

Answer

False, you cannot reference other parts of the template.

Question 13

A customer is deploying an SSL enabled web application to AWS and would like to implement a separation of roles between the EC2 service administrators that are entitled to login to instances as well as making API calls and the security officers who will maintain and have exclusive access to the application’s X.509 certificate that contains the private key.

Accepted Answer

Configure IAM policies authorizing access to the certificate store only to the security officers and terminate SSL on an ELB.

Answer

Upload the certificate on an S3 bucket owned by the security officers and accessible only by EC2 Role of the web servers.

Answer

Configure the web servers to retrieve the certificate upon boot from an CloudHSM is managed by the security officers.

Answer

Configure system permissions on the web servers to restrict access to the certificate only to the authority security officers

Question 14

A company has many AWS accounts and uses AWS Organizations to manage all of them. A solutions architect must implement a solution that the company can use to share a common network across multiple accounts. The company’s infrastructure team has a dedicated infrastructure account that has a VPC. The infrastructure team must use this account to manage the network. Individual accounts cannot have the ability to manage their own networks. However, individual accounts must be able to create AWS resources within subnets.Which combination of actions should the solutions architect perform to meet these requirements? (Choose two.)

Accepted Answer

Enable resource sharing from the AWS Organizations management account.

Accepted Answer

Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each prefix list to associate with the resource share.

Answer

Create a transit gateway in the infrastructure account.

Answer

Create VPCs in each AWS account within the organization in AWS Organizations. Configure the VPCs to share the same CIDR range and subnets as the VPC in the infrastructure account. Peer the VPCs in each individual account with the VPC in the infrastructure account.

Answer

Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share.

Question 15

Identify a true statement about the statement ID (Sid) in IAM.

Accepted Answer

You cannot expose the Sid in the IAM API.

Answer

You cannot use a Sid value as a sub-ID for a policy document's ID for services provided by SQS and SNS.

Answer

You can expose the Sid in the IAM API.

Answer

You cannot assign a Sid value to each statement in a statement array.

Question 16

A company’s processing team has an AWS account with a production application. The application runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are hosted in private subnets in a VPC in the eu- west- 1 Region. The VPC was assigned the CIDR block of 10.0.0.0/16. The billing team recently created a new AWS account and deployed an application on EC2 instances that are hosted in private subnets in a VPC in the eu-central-1 Region. The new VPC is assigned the CIDR block of 10.0.0.0/16.The processing application needs to securely communicate with the billing application over a proprietary TCP port. What should a solutions architect do to meet this requirement with the LEAST amount of operational effort?

Accepted Answer

In the billing team’s account, create a new VPC and subnets in eu-central-1 that use the CIDR block of 192.168.0.0/16. Redeploy the application to the new subnets. Configure a VPC peering connection between the two VPCs.

Answer

In the processing team’s account, add an additional CIDR block of 192.168.0.0/16 to the VPC in eu-west-1. Restart each of the EC2 instances so that they obtain a new IP address. Configure an interRegion VPC peering connection between the two VPCs.

Answer

In the billing team’s account, create a new VPC and subnets in eu-west-1 that use the CIDR block of 192.168.0.0/16. Create a VPC endpoint service (AWS PrivateLink) in the processing team’s account and an interface VPC endpoint in the new VPConfigure an inter-Region VPC peering connection in the billing team’s account between the two VPCs.

Answer

In each account, create a new VPC with the CIDR blocks of 192.168.0.0/16 and 172.16.0.0/16. Create inter-Region VPC peering connections between the billing team’s VPCs and the processing team’s VPCs. Create gateway VPC endpoints to allow traffic to route between the VPCs.

Question 17

A company is refactoring an existing web service that provides read and write access to structured data. The service must respond to short but significant spikes in the system load. The service must be fault tolerant across multiple AWS Regions.Which actions should be taken to meet these requirements?

Accepted Answer

Store the data in Amazon DocumentDB. Create a single global Amazon CloudFront distribution with a custom origin built on edge-optimized Amazon API Gateway and AWS Lambda. Assign the company’s domain as an alternate domain for the distribution, and configure Amazon Route 53 with an alias to the CloudFront distribution.

Answer

Store the data in replicated Amazon S3 buckets in two Regions. Create an Amazon CloudFront distribution in each Region, with custom origins built on Amazon API Gateway and AWS Lambda launched in each Region. Assign the company’s domain as an alternate domain for both distributions, and configure Amazon Route 53 with a failover routing policy between them.

Answer

Store the data in an Amazon DynamoDB global table in two Regions using on-demand capacity mode. In both Regions, run the web service as Amazon ECS Fargate tasks in an Auto Scaling ECS service behind an Application Load Balancer (ALB). In Amazon Route 53, configure an alias record in the company’s domain and a Route 53 latency-based routing policy with health checks to distribute traffic between the two ALBs.

Answer

Store the data in Amazon Aurora global databases. Add Auto Scaling replicas to both Regions. Run the web service on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in each Region. Configure the instances to download the web service code in the user data. In Amazon Route 53, configure an alias record for the company’s domain and a multi-value routing policy

Question 18

While assigning a tag to an instance, which of the below mentioned options is not a valid tag key/value pair?

Accepted Answer

Key: "aws:name" Value: "instanceAnswer: Aws

Answer

ey : "aws" Value:"aws"

Answer

Key: "Name :aws" Value: "instanceAnswer: Aws

Answer

Key : "nameAnswer: Aws" Value:"aws:instance

Question 19

A company requires that all internal application connectivity use private IP addresses. To facilitate this policy, a solutions architect has created interface endpoints to connect to AWS public services. Upon testing, the solutions architect notices that the service names are resolving to public IP addresses, and that internal services cannot connect to the interface endpoints. Which step should the solutions architect take to resolve this issue?

Accepted Answer

Enable the private DNS option on the VPC attributes

Answer

Update the subnet route table with a route to the interface endpoint

Answer

Configure the security group on the interface endpoint to allow connectivity to the AWS services

Answer

Configure an Amazon Route 53 private hosted zone with a conditional forwarder for the internal application

Question 20

A solutions architect is migrating an existing workload to AWS Fargate. The task can only run in a private subnet within the VPC where there is no direct connectivity from outside the system to the application. When the Fargate task is launched, the task fails with the following error:CannotPullContainerError: API error (500): Get https://111122223333.dkr.ecr.us-east-1.amazonaws.com/v2/: net/http:request canceled while waiting for connectionHow should the solutions architect correct this error?

Accepted Answer

Ensure the task is set to DISABLED for the auto-assign public IP setting when launching the task. Configure a NAT gateway in the private subnet in the VPC to route requests to the internet.

Answer

Ensure the task is set to ENABLED for the auto-assign public IP setting when launching the task.

Answer

Ensure the task is set to DISABLED for the auto-assign public IP setting when launching the task. Configure a NAT gateway in the public subnet in the VPC to route requests to the internet.

Answer

Ensure the network mode is set to bridge in the Fargate task definition.

Question 21

To ensure failover capabilities on an elastic network interface (ENI), what should you use for incoming traffic?

Accepted Answer

A secondary private IP

Answer

A Route53 A record

Answer

A secondary public IP

Answer

A secondary ENI

Question 22

Do you need to use Amazon Cognito to use the Amazon Mobile Analytics service?

Accepted Answer

No. However, it is recommend by AWS to use Amazon Cognito for security best practices.

Answer

Yes. You need to use it only if you have IAM root access.

Answer

No. You cannot use it at all, and you need to use AWS IAM accounts.

Answer

Yes. It is recommended by AWS to use Amazon Cognito to use Amazon Mobile Analytics service.

Question 23

A company has a requirement that only allows specially hardened AMIs to be launched into public subnets in a VPC, and for the AMIs to be associated with a specific security group. Allowing non-compliant instances to launch into the public subnet could present a significant security risk if they are allowed to operate.A mapping of approved AMIs to subnets to security groups exists in an Amazon DynamoDB table in the same AWS account. The company created an AWS Lambda function that, when invoked, will terminate a given Amazon EC2 instance if the combination of AMI, subnet, and security group are not approved in the DynamoDB table. What should the Solutions Architect do to MOST quickly mitigate the risk of compliance deviations?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches each time an EC2 instance is launched, and associate it with the Lambda function as the target.

Answer

Create an Amazon CloudWatch Events rule that matches each time an EC2 instance is launched using one of the allowed AMIs, and associate it with the Lambda function as the target.

Answer

For the Amazon S3 bucket receiving the AWS CloudTrail logs, create an S3 event notification configuration with a filter to match when logs contain the ec2:RunInstances action, and associate it with the Lambda function as the target.

Answer

Enable AWS CloudTrail and configure it to stream to an Amazon CloudWatch Logs group. Create a metric filter in CloudWatch to match when the ec2:RunInstances action occurs, and trigger the Lambda function when the metric is greater than 0.

Question 24

A company prefers to limit running Amazon EC2 instances to those that were launched from AMIs pre-approved by the Information Security department. The Development team has an agile continuous integration and deployment process that cannot be stalled by the solution.Which method enforces the required controls with the LEAST impact on the development process? (Choose two.)

Accepted Answer

Use IAM policies to restrict the ability of users or other automated entities to launch EC2 instances based on a specific set of pre-approved AMIs, such as those tagged in a specific way by Information Security.

Accepted Answer

Use AWS Config rules to spot any launches of EC2 instances based on non-approved AMIs, trigger an AWS Lambda function to automatically terminate the instance, and publish a message to an Amazon SNS topic to inform Information Security that this occurred.

Answer

Use regular scans within Amazon Inspector with a custom assessment template to determine if the EC2 instance that the Amazon Inspector Agent is running on is based upon a pre-approved AMI. If it is not, shut down the instance and inform Information Security by email that this occurred.

Answer

Only allow launching of EC2 instances using a centralized DevOps team, which is given work packages via notifications from an internal ticketing system. Users make requests for resources using this ticketing tool, which has manual information security approval steps to ensure that EC2 instances are only launched from approved AMIs.

Answer

Use a scheduled AWS Lambda function to scan through the list of running instances within the virtual private cloud (VPC) and determine if any of these are based on unapproved AMIs. Publish a message to an SNS topic to inform Information Security that this occurred and then shut down the instance.

Question 25

A company uses Amazon S3 to host a web application. Currently, the company uses a continuous integration tool running on an Amazon EC2 instance that builds and deploys the application by uploading it to an S3 bucket. A Solutions Architect needs to enhance the security of the company’s platform with the following requirements:A build process should be run in a separate account from the account hosting the web application. A build process should have minimal access in the account it operates in. Long-lived credentials should not be used. As a start, the Development team created two AWS accounts: one for the application named web account process; other is a named build account. Which solution should the Solutions Architect use to meet the security requirements?

Accepted Answer

In the build account, create a new IAM role, which can be assumed by Amazon EC2 only. Attach the role to the EC2 instance running the continuous integration process. Create an IAM policy to allow s3: PutObject calls on the S3 bucket in the web account. In the web account, create an S3 bucket policy attached to the S3 bucket that allows the build account to use s3:PutObject calls.

Answer

In the build account, create a new IAM role, which can be assumed by Amazon EC2 only. Attach the role to the EC2 instance running the continuous integration process. Create an IAM policy to allow s3: PutObject calls on the S3 bucket in the web account. In the web account, create an S3 bucket policy attached to the S3 bucket that allows the newly created IAM role to use s3:PutObject calls.

Answer

In the build account, create a new IAM user. Store the access key and secret access key in AWS Secrets Manager. Modify the continuous integration process to perform a lookup of the IAM user credentials from Secrets Manager. Create an IAM policy to allow s3: PutObject calls on the S3 bucket in the web account, and attack it to the user. In the web account, create an S3 bucket policy attached to the S3 bucket that allows the newly created IAM user to use s3:PutObject calls.

Answer

In the build account, modify the continuous integration process to perform a lookup of the IAM user credentials from AWS Secrets Manager. In the web account, create a new IAM user. Store the access key and secret access key in Secrets Manager. Attach the PowerUserAccess IAM policy to the IAM user.

Question 26

A user is accessing an EC2 instance on the SSH port for IP 10.20.30.40/32.Which one is a secure way to configure that the instance can be accessed only from this IP?

Accepted Answer

In the security group, open port 22 for IP 10.20.30.40/32

Answer

In the security group, open port 22 for IP 10.20.30.40

Answer

In the security group, open port 22 for IP 10.20.30.0

Answer

In the security group, open port 22 for IP 10.20.30.40/0

Question 27

What is the maximum write throughput I can provision for a single Dynamic DB table?

Accepted Answer

Dynamic DB is designed to scale without limits, but if you go beyond 10,000 you have to contact AWS first.

Answer

1,000 write capacity units

Answer

100,000 write capacity units

Answer

10,000 write capacity units

Question 28

An enterprise wants to use a third-party SaaS application. The SaaS application needs to have access to issue several API commands to discover Amazon EC2 resources running within the enterprise's account The enterprise has internal security policies that require any outside access to their environment must conform to the principles of least privilege and there must be controls in place to ensure that the credentials used by the SaaS vendor cannot be used by any other third party.Which of the following would meet all of these conditions?

Accepted Answer

Create an IAM role for cross-account access allows the SaaS provider's account to assume the role and assign it a policy that allows only the actions required by the SaaS application.

Answer

From the AWS Management Console, navigate to the Security Credentials page and retrieve the access and secret key for your account. The access policy attached to the role limits what user in Account C can do when the user accesses Account A.

Answer

Create an IAM user within the enterprise account assign a user policy to the IAM user that allows only the actions required by the SaaS application create a new access and secret key for the user and provide these credentials to the SaaS provider.

Answer

Create an IAM role for EC2 instances, assign it a policy that allows only the actions required tor the SaaS application to work, provide the role ARN to the SaaS provider to use when launching their application instances.

Question 29

A company has a data center that must be migrated to AWS as quickly as possible. The data center has a 500 Mbps AWS Direct Connect link and a separate, fully available 1 Gbps ISP connection. A Solutions Architect must transfer 20 TB of data from the data center to an Amazon S3 bucket.What is the FASTEST way transfer the data?

Accepted Answer

Send the data to AWS using the AWS Import/Export service.

Answer

Upload the data to the S3 bucket using the existing DX link.

Answer

Upload the data using an 80 TB AWS Snowball device.

Answer

Upload the data to the S3 bucket using S3 Transfer Acceleration.

Question 30

A company wants to migrate an application to Amazon EC2 from VMware Infrastructure that runs in an on-premises data center. A solutions architect must preserve the software and configuration settings during the migration. What should the solutions architect do to meet these requirements?

Accepted Answer

Create a managed-instance activation for a hybrid environment in AWS Systems Manager. Download and install Systems Manager Agent on the on-premises VM. Register the VM with Systems Manager to be a managed instance. Use AWS Backup to create a snapshot of the VM and create an AMI. Launch an EC2 instance that is based on the AMI.

Answer

Configure the AWS DataSync agent to start replicating the data store to Amazon FSx for Windows File Server. Use the SMB share to host the VMware data store. Use VM Import/Export to move the VMs to Amazon EC2.

Answer

Use the VMware vSphere client to export the application as an image in Open Virtualization Format (OVF) format. Create an Amazon S3 bucket to store the image in the destination AWS Region. Create and apply an IAM role for VM Import. Use the AWS CLI to run the EC2 import command.

Answer

Configure AWS Storage Gateway for files service to export a Common Internet File System (CIFS) share. Create a backup copy to the shared folder. Sign in to the AWS Management Console and create an AMI from the backup copy. Launch an EC2 instance that is based on the AMI.

Question 31

Your team has a tomcat-based Java application you need to deploy into development, test and production environments. After some research, you opt to use Elastic Beanstalk due to its tight integration with your developer tools and RDS due to its ease of management. Your QA team lead points out that you need to roll a sanitized set of production data into your environment on a nightly basis. Similarly, other software teams in your org want access to that same restored data via their EC2 instances in your VPC. The optimal setup for persistence and security that meets the above requirements would be the following.

Accepted Answer

Create your RDS instance as part of your Elastic Beanstalk definition and alter its security group to allow access to it from hosts in your application subnets.

Answer

Create your RDS instance separately and add its IP address to your application's DB connection strings in your code Alter its security group to allow access to it from hosts within your VPC's IP address block.

Answer

Create your RDS instance separately and pass its DNS name to your app's DB connection string as an environment variable. Create a security group for client machines and add it as a valid source for DB traffic to the security group of the RDS instance itself.

Answer

Create your RDS instance separately and pass its DNS name to your's DB connection string as an environment variable Alter its security group to allow access to It from hosts in your application subnets.

Question 32

Which of the following components of AWS Data Pipeline specifies the business logic of your data management?

Accepted Answer

Pipeline definition

Answer

Task Runner

Answer

AWS Direct Connect

Answer

Amazon Simple Storage Service 9Amazon S3)

Question 33

An organization (account ID 123412341234) has configured the IAM policy to allow the user to modify his credentials. What will the below mentioned statement allow the user to perform?<img alt="Amazon SAP-C01 image Question 713 6455 09162024005850000000"   width="538" height="203" src="https://examgecko.com/getfile/7d16497e-7ae9-48fe-9060-ebf1c7877863">

Accepted Answer

Allow the IAM user to update the membership of the group called TestingGroup

Answer

The IAM policy will throw an error due to an invalid resource name

Answer

The IAM policy will allow the user to subscribe to any IAM group

Answer

Allow the IAM user to delete the TestingGroup

Question 34

An enterprise runs 103 line-of-business applications on virtual machines in an on-premises data center. Many of the applications are simple PHP, Java, or Ruby web applications, are no longer actively developed, and serve little traffic. Which approach should be used to migrate these applications to AWS with the LOWEST infrastructure costs?

Accepted Answer

Use VM Import/Export to create AMIs for each virtual machine and run them in single-instance AWS Elastic Beanstalk environments by configuring a custom image.

Answer

Deploy the applications to single-instance AWS Elastic Beanstalk environments without a load balancer.

Answer

Use AWS SMS to create AMIs for each virtual machine and run them in Amazon EC2.

Answer

Convert each application to a Docker image and deploy to a small Amazon ECS cluster behind an Application Load Balancer.

Question 35

A company is currently in the design phase of an application that will need an RPO of less than 5 minutes and an RTO of less than 10 minutes. The solutions architecture team is forecasting that the database will store approximately 10 TB of data.As part of the design, they are looking for a database solution that will provide the company with the ability to fail over to a secondary Region. Which solution will meet these business requirements at the LOWEST cost?

Accepted Answer

Deploy an Amazon RDS instance with a cross-Region read replica in a secondary Region. In the event of a failure, promote the read replica to become the primary.

Answer

Deploy an Amazon Aurora DB cluster and take snapshots of the cluster every 5 minutes. Once a snapshot is complete, copy the snapshot to a secondary Region to serve as a backup in the event of a failure.

Answer

Deploy an Amazon Aurora DB cluster in the primary Region and another in a secondary Region. Use AWS DMS to keep the secondary Region in sync.

Answer

Deploy an Amazon RDS instance with a read replica in the same Region. In the event of a failure, promote the read replica to become the primary.

Question 36

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application. How should a solutions architect configure the web ACLs to meet these requirements?

Accepted Answer

Set the action of the web ACL rules to Count. Enable AWS WAF logging. Analyze the requests for false positives. Modify the rules to avoid any false positive. Over time, change the action of the web ACL rules from Count to Block.

Answer

Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible. Temporarily block all requests that exceed the limit. Define nested rules to narrow the scope of the rate tracking.

Answer

Set the action of the web ACL rules to Block. Use only AWS managed rule groups in the web ACLs. Evaluate the rule groups by using Amazon CloudWatch metrics with AWS WAF sampled requests or AWS WAF logs.

Answer

Use only custom rule groups in the web ACLs, and set the action to Allow. Enable AWS WAF logging. Analyze the requests for false positives. Modify the rules to avoid any false positive. Over time, change the action of the web ACL rules from Allow to Block.

Question 37

While implementing the policy keys in AWS Direct Connect, if you use and the request comes from an Amazon EC2 instance, the instance's public IP address is evaluated to determine if access is allowed.

Accepted Answer

aws:SourceIp

Answer

aws:SecureTransport

Answer

aws:EpochIP

Answer

aws:CurrentTime

Question 38

You're running an application on-premises due to its dependency on non-x86 hardware and want to use AWS for data backup. Your backup application is only able to write to POSIX-compatible blockbased storage. You have 140TB of data and would like to mount it as a single folder on your file server. Users must be able to access portions of this data while the backups are taking place. What backup solution would be most appropriate for this use case?

Accepted Answer

Use Storage Gateway and configure it to use Gateway Stored volumes.

Answer

Use Storage Gateway and configure it to use Gateway Cached volumes.

Answer

Configure your backup software to use S3 as the target for your data backups.

Answer

Configure your backup software to use Glacier as the target for your data backups.

Question 39

A company manages more than 200 separate internet-facing web applications. All of the applications are deployed to AWS in a single AWS Region. The fully qualified domain names (FQDNs) of all of the applications are made available throughHTTPS using Application Load Balancers (ALBs). The ALBs are configured to use public SSL/TLS certificates. A Solutions Architect needs to migrate the web applications to a multi-region architecture. All HTTPS services shouldcontinue to work without interruption. Which approach meets these requirements?

Accepted Answer

Request certificates for each FQDN in both the primary and secondary AWS Regions using AWS Certificate Manager. Associate the certificates with the corresponding ALBs in each AWS Region.

Answer

Request a certificate for each FQDN using AWS KMS. Associate the certificates with the ALBs in the primary AWS Region. Enable cross-region availability in AWS KMS for the certificates and associate the certificates with the ALBs in the secondary AWS Region.

Answer

Generate the key pairs and certificate requests for each FQDN using AWS KMS. Associate the certificates with the ALBs in both the primary and secondary AWS Regions.

Answer

Request a certificate for each FQDN using AWS Certificate Manager. Associate the certificates with the ALBs in both the primary and secondary AWS Regions.

Question 40

A media company uses Amazon DynamoDB to store metadata for its catalog of movies that are available to stream. Each media item contains user-facing content that includes a description of the media, a list of searchable tags, and other similar data. In addition, media items include a list of Amazon S3 key names that relate to movie files. The company stores these movie files in a single S3 bucket that has versioning enabled. The company uses Amazon CloudFront to serve these movie files.The company has 100,000 media items, and each media item can have many different S3 objects that represent different encodings of the same media. S3 objects that belong to the same media item are grouped together under the same key prefix, which is a random unique ID.Because of an expiring contract with a media provider, the company must remove 2,000 media items. The company must completely delete all DynamoDB keys and movie files on Amazon S3 that are related to these media items within 36 hours.The company must ensure that the content cannot be recovered.Which combination of actions will meet these requirements? (Choose two.)

Accepted Answer

Configure an S3 Lifecycle object expiration rule that is based on the contract’s expiration date.

Accepted Answer

Temporarily suspend versioning on the S3 bucket. Create and invoke an AWS Lambda function that deletes affected objects. Reactivate versioning when the operation is complete.

Answer

Configure the DynamoDB table with a TTL field. Create and invoke an AWS Lambda function to perform a conditional update. Set the TTL field to the time of the contract’s expiration on every affected media item.

Answer

Write a script to perform a conditional delete on all the affected DynamoDB records.

Answer

Write a script to delete objects from Amazon S3. Specify in each request a NoncurrentVersionExpiration property with a NoncurrentDays attribute set to 0.

Amazon SAP-C01 Practice Test 18

Amazon SAP-C01 Practice Tests