Quiz IT certification exam

Question 1

A company that runs applications on AWS recently subscribed to a new software-as-a-service (SaaS) data vendor. The vendor provides the data by way of a REST API that the vendor hosts in its AWS environment. The vendor offers multiple options for connectivity to the API and is working with the company to find the best way to connect. The company’s AWS account does not allow outbound internet access from its AWS environment. The vendor’s services run on AWS in the same Region as the company’s applications. A solutions architect must implement connectivity to the vendor’s API so that the API is highly available in the company’s VPC. Which solution will meet these requirements?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Connect to a public bastion host that the vendor provides. Tunnel the API traffic

Answer

Connect to the vendor’s public API address for the data service

Answer

Connect to the vendor by way of a VPC peering connection between the vendor’s VPC and the company’s VPC

Answer

Connect to the vendor by way of a VPC endpoint service that uses AWS PrivateLink

Question 2

A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 by mistake. The user is trying to create another subnet of CIDR 20.0.1.0/24. How can the user create the second subnet?

Accepted Answer

It is not possible to create a second subnet with overlapping IP CIDR without deleting the first subnet.

Answer

The user can modify the first subnet CIDR with AWS CLI

Answer

The user can modify the first subnet CIDR from the console

Answer

There is no need to update the subnet as VPC automatically adjusts the CIDR of the first subnet based on the second subnet's CIDR

Question 3

Over which of the following Ethernet standards does AWS Direct Connect link your internal network to an AWS Direct Connect location?

Accepted Answer

Single mode fiber-optic cable

Answer

Multi-mode fiber-optic cable

Answer

Shielded balanced copper cable

Answer

Twisted pair cable

Question 4

ABC has created a multi-tenant Learning Management System (LMS). The application is hosted for five different tenants (clients) in the VPCs of the respective AWS accounts of the tenant. ABC wants to setup a centralized server which can connect with the LMS of each tenant upgrade if required. ABC also wants to ensure that one tenant VPC should not be able to connect to the other tenant VPC for security reasons. How can ABC setup this scenario?

Accepted Answer

ABC has to setup one centralized VPC which will peer in to all the other VPCs of the tenants.

Answer

ABC should setup VPC peering with all the VPCs peering each other but block the IPs from CIDR of the tenant VPCs to deny them.

Answer

ABC should setup all the VPCs with the same CIDR but have a centralized VPThis way only the centralized VPC can talk to the other VPCs using VPC peering.

Answer

ABC should setup all the VPCs meshed together with VPC peering for all VPCs.

Question 5

Within the IAM service a GROUP is regarded as a:

Accepted Answer

A collection of users.

Answer

A collection of AWS accounts

Answer

It's the group of EC2 machines that gain the permissions specified in the GROUP.

Question 6

A company has implemented an ordering system using an event driven architecture. During initial testing, the system stopped processing orders. Further log analysis revealed that one order message in an Amazon Simple Queue Service (Amazon SQS) standard queue was causing an error on the backend and blocking all subsequent order messages. The visibility timeout of the queue is set to 30 seconds, and the backend processing timeout is set to 10 seconds. A solutions architect needs to analyze faulty order messages and ensure that the system continues to process subsequent messages. Which step should the solutions architect take to meet these requirements?

Accepted Answer

Configure a new SQS standard queue as a dead-letter queue to isolate the faulty messages.

Answer

Increase the backend processing timeout to 30 seconds to match the visibility timeout.

Answer

Reduce the visibility timeout of the queue to automatically remove the faulty message.

Answer

Configure a new SQS FIFO queue as a dead-letter queue to isolate the faulty messages.

Question 7

A utility company wants to collect usage data every 5 minutes from its smart meters to facilitate time-of-use metering. When a meter sends data to AWS, the data is sent to Amazon API Gateway, processed by an AWS Lambda function and stored in an Amazon DynamoDB table. During the pilot phase, the Lambda functions took from 3 to 5 seconds to complete. As more smart meters are deployed, the Engineers notice the Lambda functions are taking from 1 to 2 minutes to complete. The functions are also increasing in duration as new types of metrics are collected from the devices. There are many ProvisionedThroughputExceededException errors while performing PUT operations on DynamoDB, and there are also many TooManyRequestsException errors from Lambda.Which combination of changes will resolve these issues? (Choose two.)

Accepted Answer

Increase the write capacity units to the DynamoDB table.

Accepted Answer

Increase the memory available to the Lambda functions.

Answer

Increase the payload size from the smart meters to send more data.

Answer

Stream the data into an Amazon Kinesis data stream from API Gateway and process the data in batches.

Answer

Collect data in an Amazon SQS FIFO queue, which triggers a Lambda function to process each message.

Question 8

A company is storing data on Amazon Simple Storage Service (S3). The company's security policy mandates that data is encrypted at rest. Which of the following methods can achieve this? (Choose three.)

Accepted Answer

Use Amazon S3 server-side encryption with AWS Key Management Service managed keys.

Accepted Answer

Use Amazon S3 server-side encryption with customer-provided keys.

Accepted Answer

Encrypt the data on the client-side before ingesting to Amazon S3 using their own master key.

Answer

Use Amazon S3 server-side encryption with EC2 key pair.

Answer

Use Amazon S3 bucket policies to restrict access to the data at rest.

Answer

Use SSL to encrypt the data while in transit to Amazon S3.

Question 9

The user has provisioned the PIOPS volume with an EBS optimized instance.Generally speaking, in which I/O chunk should the bandwidth experienced by the user be measured by AWS?

Accepted Answer

256 KB

Answer

128 KB

Answer

64 KB

Answer

32 KB

Question 10

A user has created a MySQL RDS instance with PIOPS. Which of the below mentioned statements will help user understand the advantage of PIOPS?

Accepted Answer

It uses optimized EBS volumes and optimized configuration stacks

Answer

The user can achieve additional dedicated capacity for the EBS I/O with an enhanced RDS option

Answer

It uses a standard EBS volume with optimized configuration the stacks

Answer

It provides a dedicated network bandwidth between EBS and RDS

Question 11

In the context of policies and permissions in AWS IAM, the Condition element is ____________.

Accepted Answer

an optional element

Answer

crucial while writing the IAM policies

Answer

always set to null

Answer

a mandatory element

Question 12

A solutions architect is designing a publicly accessible web application that is on an Amazon CloudFront distribution with an Amazon S3 website endpoint as the origin. When the solution is deployed, the website returns an Error 403: Access Denied message.Which steps should the solutions architect take to correct the issue? (Choose two.)

Accepted Answer

Remove the S3 block public access option from the S3 bucket.

Accepted Answer

Remove the origin access identity (OAI) from the CloudFront distribution.

Answer

Remove the requester pays option from the S3 bucket.

Answer

Change the storage class from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA).

Answer

Disable S3 object versioning.

Question 13

You have an application running on an EC2 instance which will allow users to download files from a private S3 bucket using a pre-signed URL. Before generating the URL, the application should verify the existence of the file in S3. How should the application use AWS credentials to access the S3 bucket securely?

Accepted Answer

Create an IAM role for EC2 that allows list access to objects in the S3 bucket; launch the Instance with the role, and retrieve the role's credentials from the EC2 instance metadata.

Answer

Use the AWS account access keys; the application retrieves the credentials from the source code of the application.

Answer

Create an IAM user for the application with permissions that allow list access to the S3 bucket; the application retrieves the IAM user credentials from a temporary directory with permissions that allow read access only to the Application user.

Answer

Create an IAM user for the application with permissions that allow list access to the S3 bucket; launch the instance as the IAM user, and retrieve the IAM user's credentials from the EC2 instance user data.

Question 14

A company is building an application on AWS. The application sends logs to an Amazon Elasticsearch Service (Amazon ES) cluster for analysis. All data must be stored within a VPC. Some of the company’s developers work from home. Other developers work from three different company office locations. The developers need to access Amazon ES to analyze and visualize logs directly from their local development machines. Which solution will meet these requirements?

Accepted Answer

Configure and set up an AWS Client VPN endpoint. Associate the Client VPN endpoint with a subnet in the VPC. Configure a Client VPN self-service portal. Instruct the developers to connect by using the client for Client VPN.

Answer

Create a transit gateway, and connect it to the VPC. Create an AWS Site-to-Site VPN. Create an attachment to the transit gateway. Instruct the developers to connect by using an OpenVPN client.

Answer

Create a transit gateway, and connect it to the VPOrder an AWS Direct Connect connection. Set up a public VIF on the Direct Connect connection. Associate the public VIF with the transit gateway. Instruct the developers to connect to the Direct Connect connection

Answer

Create and configure a bastion host in a public subnet of the VPC. Configure the bastion host security group to allow SSH access from the company CIDR ranges. Instruct the developers to connect by using SSH.

Question 15

An organization has developed an application which provides a smarter shopping experience. They need to show a demonstration to various stakeholders who may not be able to access the in premise application so they decide to host a demo version of the application on AWS.Consequently, they will need a fixed elastic IP attached automatically to the instance when it is launched. In this scenario which of the below mentioned options will not help assign the elastic IP automatically?

Accepted Answer

Write a script which will fetch the instance metadata on system boot and assign the public IP using that metadata.

Answer

Provide an elastic IP in the user data and setup a bootstrapping script which will fetch that elastic IP and assign it to the instance.

Answer

Create a controlling application which launches the instance and assigns the elastic IP based on the parameter provided when that instance is booted.

Answer

Launch instance with VPC and assign an elastic IP to the primary network interface.

Question 16

A financial company needs to create a separate AWS account for a new digital wallet application. The company uses AWS Organizations to manage its accounts. A solutions architect uses the IAM user Support1 from the master account to create a new member account with finance1@example.com as the email address.What should the solutions architect do to create IAM users in the new member account?

Accepted Answer

Sign in to the AWS Management Console with AWS account root user credentials by using the 64-character password from the initial AWS Organizations email sent to finance1@example.com. Set up the IAM users as required.

Answer

From the master account, switch roles to assume the OrganizationAccountAccessRole role with the account ID of the new member account. Set up the IAM users as required.

Answer

Go to the AWS Management Console sign-in page. Choose “Sign in using root account credentials.” Sign in by using the email address finance1@example.com and the master account’s root password. Set up the IAM users as required.

Answer

Go to the AWS Management Console sign-in page. Sign in by using the account ID of the new member account and the Support1 IAM credentials. Set up the IAM users as required.

Question 17

You need a persistent and durable storage to trace call activity of an IVR (Interactive Voice Response) system. Call duration is mostly in the 2-3 minutes timeframe. Each traced call can be either active or terminated. An external application needs to know each minute the list of currently active calls. Usually there are a few calls/second, but once per month there is a periodic peak up to 1000 calls/second for a few hours. The system is open 24/7 and any downtime should be avoided.Historical data is periodically archived to files. Cost saving is a priority for this project.What database implementation would better fit this scenario, keeping costs as low as possible?

Accepted Answer

Use DynamoDB with a "Calls" table and a Global Secondary Index on a "IsActive" attribute that is present for active calls only. In this way the Global Secondary Index is sparse and more effective.

Answer

Use DynamoDB with a "Calls" table and a Global Secondary Index on a "State" attribute that can equal to "active" or "terminated". In this way the Global Secondary Index can be used for all items in the table.

Answer

Use RDS Multi-AZ with a "CALLS" table and an indexed "STATE" field that can be equal to "ACTIVE" or 'TERMINATED". In this way the SQL query is optimized by the use of the Index.

Answer

Use RDS Multi-AZ with two tables, one for "ACTIVE_CALLS" and one for "TERMINATED_CALLS". In this way the "ACTIVE_CALLS" table is always small and effective to access.

Question 18

What is a circular dependency in AWS CloudFormation?

Accepted Answer

When Resources form a Depend On loop.

Answer

When Nested Stacks depend on each other.

Answer

When a Template references an earlier version of itself.

Answer

When a Template references a region, which references the original Template.

Question 19

A multimedia company with a single AWS account is launching an application for a global user base. The application storage and bandwidth requirements are unpredictable. The application will use Amazon EC2 instances behind an Application Load Balancer as the web tier and will use Amazon DynamoDB as the database tier. The environment for the application must meet the following requirements:Low latency when accessed from any part of the worldWebSocket supportEnd-to-end encryptionProtection against the latest security threatsManaged layer 7 DDoS protectionWhich actions should the solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Use Amazon Route 53 and AWS Transit Gateway for content distribution. Use an Amazon Elastic Block Store (Amazon EBS) volume to store static content

Accepted Answer

Use AWS WAF with AWS Shield Advanced to protect the application

Answer

Use Amazon Route 53 and Amazon CloudFront for content distribution. Use Amazon S3 to store static content

Answer

Use AWS WAF and Amazon Detective to protect the application

Answer

Use AWS Shield Standard to protect the application

Question 20

A sys admin is maintaining an application on AWS. The application is installed on EC2 and user has configured ELB and Auto Scaling. Considering future load increase, the user is planning to launch new servers proactively so that they get registered with ELB.How can the user add these instances with Auto Scaling?

Accepted Answer

Increase the desired capacity of the Auto Scaling group

Answer

Decrease the minimum limit of the Auto Scaling group

Answer

Increase the maximum limit of the Auto Scaling group

Answer

Launch an instance manually and register it with ELB on the fly

Question 21

An organization is planning to host a Wordpress blog as well as joomla CMS on a single instance launched with VPC. The organization wants to create separate domains for each application using Route 53. The organization may have about ten instances each with these two applications. While launching each instance, the organization configured two separate network interfaces (primary + secondary ENI) with their own Elastic IPs to the instance. The suggestion was to use a public IP from AWS instead of an Elastic IP as the number of elastic IPs allocation per region is restricted in the account. What action will you recommend to the organization?

Accepted Answer

Only Elastic IP can be used by requesting limit increase, since AWS does not assign a public IP to an instance with multiple ENIs.

Answer

AWS VPC does not attach a public IP to an ENI; so the only way is to use an Elastic IP.

Answer

I agree with the suggestion but will prefer that the organization should use separate subnets with each ENI for different public IPs.

Answer

I agree with the suggestion and it is recommended to use a public IP from AWS since the organization is going to use DNS with Route 53.

Question 22

A company decided to purchase Amazon EC2 Reserved Instances. A solutions architect is tasked with implementing a solution where only the master account in AWS Organizations is able to purchase the Reserved Instances. Current and future member accounts should be blocked from purchasing Reserved Instances.Which solution will meet these requirements?

Accepted Answer

Create an AWS Config rule event that triggers automation that will terminate any Reserved Instances launched by member accounts.

Answer

Create an SCP with the Deny effect on the ec2:PurchaseReservedInstancesOffering action. Attach the SCP to the root of the organization.

Answer

Create a new organizational unit (OU) Move all current member accounts to the new OU. Create an SCP with the Deny effect on the ec2:PurchaseReservedInstancesOffering action. Attach the SCP to the new OU.

Answer

Create two new organizational units (OUs): OU1 and OU2. Move all member accounts to OU2 and the master account to OU1. Create an SCP with the Allow effect on the ec2:PurchaseReservedInstancesOffering action. Attach the SCP to OU1.

Question 23

A media company has a static web application that is generated programmatically. The company has a build pipeline that generates HTML content that is uploaded to an Amazon S3 bucket served by Amazon CloudFront. The build pipeline runs inside a Build Account. The S3 bucket and CloudFront distribution are in a Distribution Account. The build pipeline uploads the files to Amazon S3 using an IAM role in the Build Account. The S3 bucket has a bucket policy that only allows CloudFront to read objects using an origin access identity (OAI). During testing all attempts to access the application using the CloudFront URL result in an HTTP 403 Access Denied response. What should a solutions architect suggest to the company to allow access the objects in Amazon S3 through CloudFront?

Accepted Answer

Create a new cross-account IAM role in the Distribution Account with write access to the S3 bucket. Modify the build pipeline to assume this role to upload the files to the Distribution Account.

Answer

Modify the S3 upload process in the Build Account to add the bucket-owner-full-control ACL to the objects at upload.

Answer

Modify the S3 upload process in the Build Account to set the object owner to the Distribution Account.

Answer

Create a new IAM role in the Distribution Account with read access to the S3 bucket. Configure CloudFront to use this new role as its OAI. Modify the build pipeline to assume this role when uploading files from the Build Account.

Question 24

An administrator is using Amazon CloudFormation to deploy a three tier web application that consists of a web tier and application tier that will utilize Amazon DynamoDB for storage when creating the CloudFormation template. Which of the following would allow the application instance access to the DynamoDB tables without exposing API credentials?

Accepted Answer

Create an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and reference the Role in the instance profile property of the application instance.

Answer

Create an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and associate the Role to the application instances by referencing an instance profile.

Answer

Use the Parameter section in the Cloud Formation template to nave the user input Access and Secret Keys from an already created IAM user that has me permissions required to read and write from the required DynamoDB table.

Answer

Create an identity and Access Management user in the CloudFormation template that has permissions to read and write from the required DynamoDB table, use the GetAtt function to retrieve the Access and secret keys and pass them to the application instance through user-data.

Question 25

You require the ability to analyze a large amount of data, which is stored on Amazon S3 using Amazon Elastic Map Reduce. You are using the cc2 8xlarge instance type, whose CPUs are mostly idle during processing. Which of the below would be the most cost efficient way to reduce the runtime of the job?

Accepted Answer

Use smaller instances that have higher aggregate I/O performance.

Answer

Create more, smaller flies on Amazon S3.

Answer

Add additional cc2 8xlarge instances by introducing a task group.

Answer

Create fewer, larger files on Amazon S3.

Question 26

A newspaper organization has an on-premises application which allows the public to search its back catalogue and retrieve individual newspaper pages via a website written in Java. They have scanned the old newspapers into JPEGs (approx 17TB) and used Optical Character Recognition (OCR) to populate a commercial search product. The hosting platform and software are now end of life and the organization wants to migrate its archive to AWS and produce a cost efficient architecture and still be designed for availability and durability.Which is the most appropriate?

Accepted Answer

Use S3 with standard redundancy to store and serve the scanned files, use CloudSearch for query processing, and use Elastic Beanstalk to host the website across multiple availability zones.

Answer

Use S3 with reduced redundancy lo store and serve the scanned files, install the commercial search application on EC2 Instances and configure with auto-scaling and an Elastic Load Balancer.

Answer

Model the environment using CloudFormation use an EC2 instance running Apache webserver and an open source search application, stripe multiple standard EBS volumes together to store the JPEGs and search index.

Answer

Use a single-AZ RDS MySQL instance lo store the search index 33d the JPEG images use an EC2 instance to serve the website and translate user queries into SQL.

Answer

Use a CloudFront download distribution to serve the JPEGs to the end users and Install the current commercial search product, along with a Java Container Tor the website on EC2 instances and use Route53 with DNS round-robin.

Question 27

A fleet of Amazon ECS instances is used to poll an Amazon SQS queue and update items in an Amazon DynamoDB database. Items in the table are not being updated, and the SQS queue is filling up. Amazon CloudWatch Logs are showing consistent 400 errors when attempting to update the table. The provisioned write capacity units are appropriately configured, and no throttling is occurring. What is the LIKELY cause of the failure?

Accepted Answer

The ECS instance task execution IAM role was modified.

Answer

The ECS service was deleted.

Answer

The ECS configuration does not contain an Auto Scaling group.

Answer

The ECS task role was modified.

Question 28

A mobile app has become very popular, and usage has gone from a few hundred to millions of users. Users capture and upload images of activities within a city, and provide ratings and recommendations. Data access patterns are unpredictable.The current application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is experiencing slowdowns and costs are growing rapidly. Which changes should a solutions architect make to the application architecture to control costs and improve performance?

Accepted Answer

Store static content in an Amazon S3 bucket using the Intelligent Tiering storage class. Use an Amazon CloudFront distribution in front of the S3 bucket and the ALB.

Answer

Create an Amazon CloudFront distribution and place the ALB behind the distribution. Store static content in Amazon S3 in an Infrequent Access storage class.

Answer

Place AWS Global Accelerator in front of the ALB. Migrate the static content to Amazon EFS, and then run an AWS Lambda function to resize the images during the migration process.

Answer

Move the application code to AWS Fargate containers and swap out the EC2 instances with the Fargate containers.

Question 29

How is AWS readily distinguished from other vendors in the traditional IT computing landscape?

Accepted Answer

Secure. Flexible. Cost-effective. Scalable and elastic. Experienced

Answer

Experienced. Scalable and elastic. Secure. Cost-effective. Reliable

Answer

Secure. Flexible. Cost-effective. Scalable and elastic. Global

Answer

Flexible. Cost-effective. Dynamic. Secure. Experienced.

Question 30

A Solutions Architect is designing the storage layer for a data warehousing application. The data files are large, but they have statically placed metadata at the beginning of each file that describes the size and placement of the file’s index. The data files are read in by a fleet of Amazon EC2 instances that store the index size, index location, and other category information about the data file in a database. That database is used by Amazon EMR to group files together for deeper analysis.What would be the MOST cost-effective, high availability storage solution for this workflow?

Accepted Answer

Store the data files in Amazon S3 and use Range GET for each file’s metadata, then index the relevant data.

Answer

Store the data files in Amazon EFS mounted by the EC2 fleet and EMR nodes.

Answer

Store the data files on Amazon EBS volumes and allow the EC2 fleet and EMR to mount and unmount the volumes where they are needed.

Answer

Store the content of the data files in Amazon DynamoDB tables with the metadata, index, and data as their own keys.

Question 31

A user is running a critical batch process which runs for 1 hour and 50 mins every day at a fixed time. Which of the below mentioned options is the right instance type and costing model in this case if the user performs the same task for the whole year?

Accepted Answer

EBS backed instance with on-demand instance pricing.

Answer

Instance store backed instance with spot instance pricing.

Answer

EBS backed instance with standard reserved upfront instance pricing.

Answer

EBS backed scheduled reserved instance with partial instance pricing.

Question 32

An organization is setting up an application on AWS to have both High Availability (HA) and Disaster Recovery (DR). The organization wants to have both Recovery point objective (RPO) and Recovery time objective (RTO) of 10 minutes. Which of the below mentioned service configurations does not help the organization achieve the said RPO and RTO?

Accepted Answer

Create ELB with multi-region routing to allow automated failover when required.

Answer

Take a snapshot of the data every 10 minutes and copy it to the other region.

Answer

Use an elastic IP to assign to a running instance and use Route 53 to map the user's domain with that IP.

Answer

Use an AMI copy to keep the AMI available in other regions.

Question 33

A financial services company in North America plans to release a new online web application to its customers on AWS. The company will launch the application in the us-east-1 Region on Amazon EC2 instances. The application must be highly available and must dynamically scale to meet user traffic. The company also wants to implement a disaster recovery environment for the application in the us-west1 Region by using active-passive failover. Which solution will meet these requirements?

Accepted Answer

Create a VPC in us-east-1 and a VPC in us-west-1. In the us-east-1 VPC, create an Application Load Balancer (ALB) that extends across multiple Availability Zones in that VPC. Create an Auto Scaling group that deploys the EC2 instances across the multiple Availability Zones in the us-east-1 VPC. Place the Auto Scaling group behind the ALSet up the same configuration in the us-west-1 VPC. Create an Amazon Route 53 hosted zone. Create separate records for each ALEnable health checks to ensure high availability between Regions.

Answer

Create a VPC in us-east-1 and a VPC in us-west-1. Configure VPC peering. In the us-east-1 VPC, create an Application Load Balancer (ALB) that extends across multiple Availability Zones in both VPCs. Create an Auto Scaling group that deploys the EC2 instances across the multiple Availability Zones in both VPCs. Place the Auto Scaling group behind the ALB.

Answer

Create a VPC in us-east-1 and a VPC in us-west-1. In the us-east-1 VPC, create an Application Load Balancer (ALB) that extends across multiple Availability Zones in that VPCreate an Auto Scaling group that deploys the EC2 instances across the multiple Availability Zones in the us-east-1 VPPlace the Auto Scaling group behind the ALB. Set up the same configuration in the us-west-1 VPCreate an Amazon Route 53 hosted zone. Create separate records for each ALB. Enable health checks and configure a failover routing policy for each record.

Answer

Create a VPC in us-east-1 and a VPC in us-west-1. Configure VPC peering. In the us-east-1 VPC, create an Application Load Balancer (ALB) that extends across multiple Availability Zones in both VPCs. Create an Auto Scaling group that deploys the EC2 instances across the multiple Availability Zones in both VPCs. Place the Auto Scaling group behind the ALB. Create an Amazon Route 53 hosted zone. Create a record for the ALB.

Question 34

By default, Amazon Cognito maintains the last-written version of the data. You can override this behavior and resolve data conflicts programmatically. In addition, push synchronization allows you to use Amazon Cognito to send a silent notification to all devices associated with an identity to notify them that new data is available.

Accepted Answer

push

Answer

get

Answer

post

Answer

pull

Question 35

A company has released a new version of a website to target an audience in Asia and South America. The website’s media assets are hosted on Amazon S3 and have an Amazon CloudFront distribution to improve end-user performance. However, users are having a poor login experience, the authentication service is only available in the us-east-1 AWS Region. How can the Solutions Architect improve the login experience and maintain high security and performance with minimal management overhead?

Accepted Answer

Use Amazon Lambda@Edge attached to the CloudFront viewer request trigger to authenticate and authorize users by maintaining a secure cookie token with a session expiry to improve the user experience in multiple geographies.

Answer

Replicate the setup in each new geography and use Amazon Route 53 geo-based routing to route traffic to the AWS Region closest to the users.

Answer

Use an Amazon Route 53 weighted routing policy to route traffic to the CloudFront distribution. Use CloudFront cached HTTP methods to improve the user login experience.

Answer

Replicate the setup in each geography and use Network Load Balancers to route traffic to the authentication service running in the closest region to users.

Question 36

A company has developed a new release of a popular video game and wants to make it available for public download. The new release package is approximately 5 GB in size. The company provides downloads for existing releases from a Linuxbased, publicly facing FTP site hosted in an on-premises data center. The company expects the new release will be downloaded by users worldwide. The company wants a solution that provides improved download performance and low transfer costs, regardless of a user’s location.Which solutions will meet these requirements?

Accepted Answer

Configure Amazon Route 53 and an Amazon S3 bucket for website hosting. Upload the game files to the S3 bucket. Use Amazon CloudFront for the website. Publish the game download URL for users to download the package.

Answer

Store the game files on Amazon EBS volumes mounted on Amazon EC2 instances within an Auto Scaling group. Configure an FTP service on the EC2 instances. Use an Application Load Balancer in front of the Auto Scaling group. Publish the game download URL for users to download the package.

Answer

Store the game files on Amazon EFS volumes that are attached to Amazon EC2 instances within an Auto Scaling group. Configure an FTP service on each of the EC2 instances. Use an Application Load Balancer in front of the Auto Scaling group. Publish the game download URL for users to download the package.

Answer

Configure Amazon Route 53 and an Amazon S3 bucket for website hosting. Upload the game files to the S3 bucket. Set Requester Pays for the S3 bucket. Publish the game download URL for users to download the package.

Question 37

A user is trying to create a PIOPS EBS volume with 4000 IOPS and 100 GB size. AWS does not allow the user to create this volume. What is the possible root cause for this?

Accepted Answer

The ratio between IOPS and the EBS volume is lower than 50

Answer

PIOPS is supported for EBS higher than 500 GB size

Answer

The maximum IOPS supported by EBS is 3000

Answer

The ratio between IOPS and the EBS volume is higher than 30

Question 38

An enterprise company is using a multi-account AWS strategy. There are separate accounts for development staging and production workloads. To control costs and improve governance the following requirements have been defined:The company must be able to calculate the AWS costs for each project.The company must be able to calculate the AWS costs for each environment development staging and production. Commonly deployed IT services must be centrally managed.Business units can deploy pre-approved IT services only.Usage of AWS resources in the development account must be limited.Which combination of actions should be taken to meet these requirements? (Choose three.)

Accepted Answer

Configure AWS Trusted Advisor to obtain weekly emails with cost-saving estimates.

Accepted Answer

Configure a billing alarm in Amazon CloudWatch.

Accepted Answer

Configure SCPs in AWS Organizations to allow services available using AWS.

Answer

Apply environment, cost center, and application name tags to all taggable resources.

Answer

Configure custom budgets and define thresholds using Cost Explorer.

Answer

Create a portfolio for each business unit and add products to the portfolios using AWS CloudFormation in AWS Service Catalog.

Question 39

You have been asked to design the storage layer for an application. The application requires disk performance of at least 100,000 IOPS. In addition, the storage layer must be able to survive the loss of an individual disk, EC2 instance, or Availability Zone without any data loss. The volume you provide must have a capacity of at least 3 TB. Which of the following designs will meet these objectives?

Accepted Answer

Instantiate an i2.8xlarge instance in us-east-1a. Create a RAID 0 volume using the four 800GB SSD ephemeral disks provided with the instance. Configure synchronous, block-level replication to an identically configured instance in us- east-1b.

Answer

Instantiate a c3.8xlarge instance in us-east-1. Provision 4x1TB EBS volumes, attach them to the instance, and configure them as a single RAID 5 volume. Ensure that EBS snapshots are performed every 15 minutes.

Answer

Instantiate a c3.8xlarge instance in us-east-1. Provision 3xlTB EBS volumes, attach them to the Instance, and configure them as a single RAID 0 volume. Ensure that EBS snapshots are performed every 15 minutes.

Answer

Instantiate an i2.8xlarge instance in us-east-1a. Create a RAID 0 volume using the four 800GB SSD ephemeral disks provided with the instance. Provision 3x1TB EBS volumes, attach them to the instance, and configure them as a second RAID 0 volume. Configure synchronous, block-level replication from the ephemeral-backed volume to the EBS-backed volume.

Answer

Instantiate a c3.8xlarge instance in us-east-1. Provision an AWS Storage Gateway and configure it for 3 TB of storage and 100,000 IOPS. Attach the volume to the instance.

Question 40

A company uses AWS Organizations. The company has an organization that has a central management account. The company plans to provision multiple AWS accounts for different departments. All department accounts must be a member of the company’s organization.Compliance requirements state that each account must have only one VPC. Additionally, each VPC must have an identical network security configuration that includes fully configured subnets, gateways, network ACLs, and security groups. The company wants this security setup to be automatically applied when a new department account is created. The company wants to use the central management account for all security operations, but the central management account should not have the security setup.Which approach meets these requirements with the LEAST amount of setup?

Accepted Answer

Create a new organization with the central management account. Invite all AWS department accounts into the new organization. From the central management account, create an AWS CloudFormation template that includes the VPC and the network security configurations. Create a CloudFormation stack that is based on this template. Apply the CloudFormation stack to the newly created organization.

Answer

Create an OU within the company’s organization. Add department accounts to the OU. From the central management account, create an AWS CloudFormation template that includes the VPC and the network security configurations. Create a CloudFormation stack set by using this template file with automated deployment enabled. Apply the CloudFormation stack set to the OU.

Answer

Invite department accounts to the company’s organization. From the central management account, create an AWS CloudFormation template that includes the VPC and the network security configurations. Create an AWS CodePipeline pipeline that will deploy the network security setup to the newly created account. Specify the creation of an account as an event hook. Apply the event hook to the pipeline.

Answer

Invite department accounts to the company’s organization. From the central management account, create an AWS CloudFormation template that includes the VPC and the network security configurations. Create an AWS Lambda function that will deploy the VPC and the network security setup to the newly created account. Create an event that watches for account creation. Configure the event to invoke the pipeline.

Amazon SAP-C01 Practice Test 19

Amazon SAP-C01 Practice Tests

Amazon SAP-C01 Practice Test 19

Question

Amazon SAP-C01 Practice Tests

Practice Tests