Quiz IT certification exam

Question 1

A company needs to run a software package that has a license that must be run on the same physical host for the duration of its use. The software package is only going to be used for 90 days. The company requires patching and restarting of all instances every 30 days.

How can these requirements be met using AWS?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Run the instance on a dedicated host with Host Affinity set to Host.

Answer

Run a dedicated instance with auto-placement disabled.

Answer

Run an On-Demand Instance with a Reserved Instance to ensure consistent placement.

Answer

Run the instance on a licensed host with termination set for 90 days.

Question 2

A company is running a workload that consists of thousands of Amazon EC2 instances. The workload is running in a VPC that contains several public subnets and private subnets. The public subnets have a route for 0.0.0.0/0 to an existing internet gateway. The private subnets have a route for 0.0.0.0/0 to an existing NAT gateway.A solutions architect needs to migrate the entire fleet of EC2 instances to use IPv6. The EC2 instances that are in private subnets must not be accessible from the public internet. What should the solutions architect do to meet these requirements?

Accepted Answer

Update the existing VPC, and associate an Amazon-provided IPv6 CIDR block with the VPC and all subnets. Create an egress-only internet gateway. Update the VPC route tables for all private subnets, and add a route for ::/0 to the egress-only internet gateway.

Answer

Update the existing VPC, and associate a custom IPv6 CIDR block with the VPC and all subnets. Update all the VPC route tables, and add a route for ::/0 to the internet gateway.

Answer

Update the existing VPC, and associate an Amazon-provided IPv6 CIDR block with the VPC and all subnets. Update the VPC route tables for all private subnets, and add a route for ::/0 to the NAT gateway.

Answer

Update the existing VPC, and associate a custom IPv6 CIDR block with the VPC and all subnets. Create a new NAT gateway, and enable IPv6 support. Update the VPC route tables for all private subnets, and add a route for ::/0 to the IPv6- enabled NAT gateway.

Question 3

A user wants to create a public subnet in VPC and launch an EC2 instance within it. The user has not selected the option to assign a public IP address while launching the instance. Which of the below mentioned statements is true with respect to this scenario?

Accepted Answer

The user would need to create a default route to IGW in subnet's route table and then attach an elastic IP to the instance to connect from the internet

Answer

The instance will always have a public DNS attached to the instance by default

Answer

The user can directly attach an elastic IP to the instance

Answer

The instance will never launch if the public IP is not assigned

Question 4

You have set up a huge amount of network infrastructure in AWS and you now need to think about monitoring all of this. You decide CloudWatch will best fit your needs but you are unsure of the pricing structure and the limitations of CloudWatch.Which of the following statements is TRUE in relation to the limitations of CloudWatch?

Accepted Answer

You get 10 CloudWatch metrics, 10 alarms, 1,000,000 API requests, and 1,000 Amazon SNS email notifications per customer per month for free.

Answer

You get 100 CloudWatch metrics, 100 alarms, 10,000,000 API requests, and 10,000 Amazon SNS email notifications per customer per month for free.

Answer

You get 10 CloudWatch metrics, 10 alarms, 1,000 API requests, and 100 Amazon SNS email notifications per customer per month for free.

Answer

You get 100 CloudWatch metrics, 100 alarms, 1,000,000 API requests, and 1,000 Amazon SNS email notifications per customer per month for free.

Question 5

A company must deploy multiple independent instances of an application. The front-end application is internet accessible. However, corporate policy stipulates that the backends are to be isolated from each other and the internet, yet accessible from a centralized administration server. The application setup should be automated to minimize the opportunity for mistakes as new instances are deployed.Which option meets the requirements and MINIMIZES costs?

Accepted Answer

Use an AWS CloudFormation template to create identical IAM roles for each region. Use AWS CloudFormation StackSets to deploy each application instance by using parameters to customize for each instance, and use security groups to isolate each instance while permitting access to the central server.

Answer

Create each instance of the application IAM roles and resources in separate accounts by using AWS CloudFormation StackSets. Include a VPN connection to the VPN gateway of the central administration server.

Answer

Duplicate the application IAM roles and resources in separate accounts by using a single AWS CloudFormation template. Include VPC peering to connect the VPC of each application instance to a central VPC.

Answer

Use the parameters of the AWS CloudFormation template to customize the deployment into separate accounts. Include a NAT gateway to allow communication back to the central administration server.

Question 6

A web design company currently runs several FTP servers that their 250 customers use to upload and download large graphic files They wish to move this system to AWS to make it more scalable, but they wish to maintain customer privacy and Keep costs to a minimum.What AWS architecture would you recommend?

Accepted Answer

ASK their customers to use an S3 client instead of an FTP client. Create a single S3 bucket Create an IAM user for each customer Put the IAM Users in a Group that has an IAM policy that permits access to sub-directories within the bucket via use of the 'username' Policy variable.

Answer

Create a single S3 bucket with Reduced Redundancy Storage turned on and ask their customers to use an S3 client instead of an FTP client Create a bucket for each customer with a Bucket Policy that permits access only to that one customer.

Answer

Create an auto-scaling group of FTP servers with a scaling policy to automatically scale-in when minimum network traffic on the auto-scaling group is below a given threshold. Load a central list of ftp users from S3 as part of the user Data startup script on each Instance.

Answer

Create a single S3 bucket with Requester Pays turned on and ask their customers to use an S3 client instead of an FTP client Create a bucket tor each customer with a Bucket Policy that permits access only to that one customer.

Question 7

How many g2.2xlarge on-demand instances can a user run in one region without taking any limit increase approval from AWS?

Accepted Answer

5

Answer

20

Answer

2

Answer

10

Question 8

A company has a complex web application that leverages Amazon CloudFront for global scalability and performance. Over time, users report that the web application is slowing down. The company’s operations team reports that the CloudFront cache hit ratio has been dropping steadily. The cache metrics report indicates that query strings on some URLs are inconsistently ordered and are specified sometimes in mixed- case letters and sometimes in lowercase letters.Which set of actions should the solutions architect take to increase the cache hit ratio as quickly possible?

Accepted Answer

Update the CloudFront distribution to disable caching based on query string parameters.

Answer

Deploy a Lambda@Edge function to sort parameters by name and force them to be lowercase. Select the CloudFront viewer request trigger to invoke the function.

Answer

Deploy a reverse proxy after the load balancer to post process the emitted URLs in the application to force the URL strings to be lowercase.

Answer

Update the CloudFront distribution to specify case-insensitive query string processing.

Question 9

A solutions architect must implement a multi-Region architecture for an Amazon RDS for PostgreSQL database that supports a web application. The database launches from an AWS CloudFormation template that includes AWS services and features that are present in both the primary and secondary Regions.The database is configured for automated backups, and it has an RTO of 15 minutes and an RPO of 2 hours. The web application is configured to use an Amazon Route 53 record to route traffic to the database. Which combination of steps will result in a highly available architecture that meets all the requirements? (Choose two.)

Accepted Answer

Create a cross-Region read replica of the database in the secondary Region. Configure an AWS Lambda function in the secondary Region to promote the read replica during failover event.

Accepted Answer

Create a failover routing policy in Route 53 for the database DNS record. Set the primary and secondary endpoints to the endpoints in each Region.

Answer

In the primary Region, create a health check on the database that will invoke an AWS Lambda function when a failure is detected. Program the Lambda function to recreate the database from the latest database snapshot in the secondary Region and update the Route 53 host records for the database.

Answer

Create an AWS Lambda function to copy the latest automated backup to the secondary Region every 2 hours.

Answer

Create a hot standby database in the secondary Region. Use an AWS Lambda function to restore the secondary database to the latest RDS automatic backup in the event that the primary database fails.

Question 10

A user is thinking to use EBS PIOPS volume.Which of the below mentioned options is a right use case for the PIOPS EBS volume?

Accepted Answer

Mongo DB

Answer

Analytics

Answer

System boot volume

Answer

Log processing

Question 11

A company is creating an account strategy so that they can begin using AWS. The Security team will provide each team with the permissions they need to follow the principle or least privileged access. Teams would like to keep their resources isolated from other groups, and the Finance team would like each team’s resource usage separated for billing purposes. Which account creation process meets these requirements and allows for changes?

Accepted Answer

Create individual accounts for each team. Assign the security account as the master account, and enable consolidated billing for all other accounts. Create a cross-account role for security to manage accounts, and send logs to a bucket in the security account.

Answer

Create a new AWS Organizations account. Create groups in Active Directory and assign them to roles in AWS to grant federated access. Require each team to tag their resources, and separate bills based on tags. Control access to resources through IAM granting the minimally required privilege.

Answer

Create a new AWS account, and use AWS Service Catalog to provide teams with the required resources. Implement a third-party billing solution to provide the Finance team with the resource use for each team based on tagging. Isolate resources using IAM to avoid account sprawl. Security will control and monitor logs and permissions.

Answer

Create a master account for billing using Organizations, and create each team’s account from that master account. Create a security account for logs and cross-account access. Apply service control policies on each account, and grant the Security team cross-account access to all accounts. Security will create IAM policies for each account to maintain least privilege access.

Question 12

Which of the following statements is correct about the number of security groups and rules applicable for an EC2-Classic instance and an EC2-VPC network interface?

Accepted Answer

In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 100 rules to a security group. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 50 rules to a security group.

Answer

In EC2-Classic, you can associate an instance with up to 5 security groups and add up to 50 rules to a security group. In EC2-VPC, you can associate a network interface with up to 500 security groups and add up to 100 rules to a security group.

Answer

In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 50 rules to a security group. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 100 rules to a security group.

Answer

In EC2-Classic, you can associate an instance with up to 5 security groups and add up to 100 rules to a security group. In EC2-VPC, you can associate a network interface with up to 500 security groups and add up to 50 rules to a security group.

Question 13

An organization is setting up RDS for their applications. The organization wants to secure RDS access with VPC. Which of the following options is not required while designing the RDS with VPC?

Accepted Answer

The organization must create a subnet group with public and private subnets. Both the subnets can be in the same or separate AZ.

Answer

The organization should keep minimum of one IP address in each subnet reserved for RDS failover.

Answer

If the organization is connecting RDS from the internet it must enable the VPC attributes DNS hostnames and DNS resolution.

Answer

The organization must create a subnet group with VPC using more than one subnet which are a part of separate AZs.

Question 14

An organization is planning to use NoSQL DB for its scalable data needs. The organization wants to host an application securely in AWS VPC. What action can be recommended to the organization?

Accepted Answer

The organization should setup their own NoSQL cluster on the AWS instance and configure route tables and subnets.

Answer

The organization should only use a DynamoDB because by default it is always a part of the default subnet provided by AWS.

Answer

The organization should use a DynamoDB while creating a table within the public subnet.

Answer

The organization should use a DynamoDB while creating a table within a private subnet.

Question 15

MapMySite is setting up a web application in the AWS VPC. The organization has decided to use an AWS RDS instead of using its own DB instance for HA and DR requirements. The organization also wants to secure RDS access. How should the web application be setup with RDS?

Accepted Answer

Setup a public and two private subnets in different AZs within a VPC and create a subnet group. Launch RDS with that subnet group.

Answer

Create a VPC with one public and one private subnet. Launch an application instance in the public subnet while RDS is launched in the private subnet.

Answer

Create a network interface and attach two subnets to it. Attach that network interface with RDS while launching a DB instance.

Answer

Create two separate VPCs and launch a Web app in one VPC and RDS in a separate VPC and connect them with VPC peering.

Question 16

A company operates an on-premises software-as-a-service (SaaS) solution that ingests several files daily. The company provides multiple public SFTP endpoints to its customers to facilitate the file transfers. The customers add the SFTP endpoint IP addresses to their firewall allow list for outbound traffic. Changes to the SFTP endpoint IP addresses are not permitted. The company wants to migrate the SaaS solution to AWS and decrease the operational overhead of the file transfer service. Which solution meets these requirements?

Accepted Answer

Register the customer-owned block of IP addresses in the company’s AWS account. Create Elastic IP addresses from the address pool and assign them to an AWS Transfer for SFTP endpoint. Use AWS Transfer to store the files in Amazon S3.

Answer

Add a subnet containing the customer-owned block of IP addresses to a VPC. Create Elastic IP addresses from the address pool and assign them to an Application Load Balancer (ALB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the ALStore the files in attached Amazon Elastic Block Store (Amazon EBS) volumes.

Answer

Register the customer-owned block of IP addresses with Amazon Route 53. Create alias records in Route 53 that point to a Network Load Balancer (NLB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the NLB.Store the files in Amazon S3.

Answer

Register the customer-owned block of IP addresses in the company’s AWS account. Create Elastic IP addresses from the address pool and assign them to an Amazon S3 VPC endpoint. Enable SFTP support on the S3 bucket.

Question 17

A fitness tracking company serves users around the world, with its primary markets in North America and Asia. The company needs to design an infrastructure for its read-heavy user authorization application with the following requirements:Be resilient to problem with the application in any Region.Write to a database in a single Region.Read from multiple Regions.Support resiliency across application tiers in each Region.Support the relational database semantics reflected in the application.Which combination of steps should a solutions architect take? (Choose two.)

Accepted Answer

Deploy web, application, and MySQL database servers to Amazon EC2 instance in each Region. Set up the application so that reads and writes are local to the Region. Create snapshots of the web, application, and database servers and store the snapshots in an Amazon S3 bucket in both Regions. Set up cross-Region replication for the database layer.

Accepted Answer

Set up web, application, and Amazon RDS for MySQL instances in each Region. Set up the application so that reads are local and writes are partitioned based on the user. Set up a Multi-AZ failover for the web, application, and database servers.Set up cross-Region replication for the database layer.

Answer

Use an Amazon Route 53 geoproximity routing policy combined with a multivalue answer routing policy.

Answer

Use an Amazon Route 53 geolocation routing policy combined with a failover routing policy.

Answer

Set up active-active web and application servers in each Region. Deploy an Amazon Aurora global database with clusters in each Region. Set up the application to use the in-Region Aurora database endpoints. Create snapshots of the web application servers and store them in an Amazon S3 bucket in both Regions.

Question 18

An organization is planning to setup a management network on the AWS VPC. The organization is trying to secure the webserver on a single VPC instance such that it allows the internet traffic as well as the back-end management traffic. The organization wants to make so that the back end management network interface can receive the SSH traffic only from a selected IP range, while the internet facing webserver will have an IP address which can receive traffic from all the internet IPs.How can the organization achieve this by running web server on a single instance?

Accepted Answer

The organization should create two network interfaces with separate subnets so one instance can have two subnets and the respective security groups for controlled access.

Answer

It is not possible to have two IP addresses for a single instance.

Answer

The organization should create two network interfaces with the same subnet and security group to assign separate IPs to each network interface.

Answer

The organization should launch an instance with two separate subnets using the same network interface which allows to have a separate CIDR as well as security groups.

Question 19

A company has an application behind a load balancer with enough Amazon EC2 instances to satisfy peak demand. Scripts and third-party deployment solutions are used to configure EC2 instances when demand increases or an instance fails. The team must periodically evaluate the utilization of the instance types to ensure that the correct sizes are deployed. How can this workload be optimized to meet these requirements?

Accepted Answer

Deploy the application as a Docker image by using Amazon ECS. Set up Amazon EC2 Auto Scaling and Amazon ECS scaling. Register for AWS Business Support and use Trusted Advisor checks to provide suggestions on cost savings.

Answer

Use CloudFormer to create AWS CloudFormation stacks from the current resources. Deploy that stack by using AWS CloudFormation in the same region. Use Amazon CloudWatch alarms to send notifications about underutilized resources to provide cost-savings suggestions.

Answer

Create an Auto Scaling group to scale the instances, and use AWS CodeDeploy to perform the configuration. Change from a load balancer to an Application Load Balancer. Purchase a third-party product that provides suggestions for cost savings on AWS resources.

Answer

Deploy the application by using AWS Elastic Beanstalk with default options. Register for an AWS Support Developer plan. Review the instance usage for the application by using Amazon CloudWatch, and identify less expensive instances that can handle the load. Hold monthly meetings to review new instance types and determine whether Reserved Instances should be purchased.

Question 20

A company has multiple AWS accounts and manages these accounts which AWS Organizations. A developer was given IAM user credentials to access AWS resources. The developer should have readonly access to all Amazon S3 buckets in the account. However, when the developer tries to access the S3 buckets from the console, they receive an access denied error message with no bucket listed. A solution architect reviews the permissions and finds that the developer’s IAM user is listed as having read-only access to all S3 buckets in the account. Which additional steps should the solutions architect take to troubleshoot the issue? (Choose two.)

Accepted Answer

Check for the permissions boundaries set for the IAM user.

Accepted Answer

Check if an appropriate IAM role is attached to the IAM user.

Answer

Check the bucket policies for all S3 buckets.

Answer

Check the ACLs for all S3 buckets.

Answer

Check the SCPs set at the organizational units (OUs).

Question 21

A company has a photo sharing social networking application. To provide a consistent experience for users, the company performs some image processing on the photos uploaded by users before publishing on the application. The image processing is implemented using a set of Python libraries.The current architecture is as follows:The image processing Python code runs in a single Amazon EC2 instance and stores the processed images in an Amazon S3 bucket named ImageBucket. The front-end application, hosted in another bucket, loads the images from ImageBucket to display to users.With plans for global expansion, the company wants to implement changes in its existing architecture to be able to scale for increased demand on the application and reduce management complexity as the application scales. Which combination of changes should a solutions architect make? (Choose two.)

Accepted Answer

Use Amazon CloudFront in front of ImageBucket.

Accepted Answer

Deploy the applications in an Amazon ECS cluster and apply Service Auto Scaling.

Answer

Place the image processing EC2 instance into an Auto Scaling group.

Answer

Use AWS Lambda to run the image processing tasks.

Answer

Use Amazon Rekognition for image processing.

Question 22

A company wants to analyze log data using date ranges with a custom application running on AWS. The application generates about 10 GB of data every day, which is expected to grow. A Solutions Architect is tasked with storing the data in Amazon S3 and using Amazon Athena to analyze the data.Which combination of steps will ensure optimal performance as the data grows? (Choose two.)

Accepted Answer

Store the data in multiple S3 buckets.

Accepted Answer

Store the data in Amazon S3 in a columnar format, such as Apache Parquet or Apache ORC.

Answer

Store each object in Amazon S3 with a random string at the front of each key.

Answer

Store the data in Amazon S3 in objects that are smaller than 10 MB.

Answer

Store the data using Apache Hive partitioning in Amazon S3 using a key that includes a date, such as dt=2019-02.

Question 23

A company has a VPC with two domain controllers running Active Directory in the default configuration. The VPC DHCP options set is configured to use the IP addresses of the two domain controllers. There is a VPC interface endpoint defined; but instances within the VPC are not able to resolve the private endpoint addresses.Which strategies would resolve this issue? (Choose two.)

Accepted Answer

Update the DNS service on the Active Directory servers to forward all non-authoritative queries to the VPC Resolver.

Accepted Answer

Update the DNS service on the Active Directory servers to forward all queries to the VPC Resolver.

Answer

Define an outbound Amazon Route 53 Resolver. Set a conditional forward rule for the Active Directory domain to the Active Directory servers. Update the VPC DHCP options set to AmazonProvidedDNS.

Answer

Define an inbound Amazon Route 53 Resolver. Set a conditional forward rule for the Active Directory domain to the Active Directory servers. Update the VPC DHCP options set to AmazonProvidedDNS.

Answer

Update the DNS service on the client instances to split DNS queries between the Active Directory servers and the VPC Resolver.

Question 24

A company runs applications on Amazon EC2 instances. The company plans to begin using an Auto Scaling group for the instances. As part of this transition, a solutions architect must ensure that Amazon CloudWatch Logs automatically collects logs from all new instances. The new Auto Scaling group will use a launch template that includes the Amazon Linux 2 AMI and no key pair. Which solution meets these requirements?

Accepted Answer

Create an Amazon CloudWatch agent configuration for the workload. Store the CloudWatch agent configuration in an Amazon S3 bucket. Write an EC2 user data script to fetch the configuration file from Amazon S3. Configure the CloudWatch agent on the instance during initial boot.

Answer

Create an Amazon CloudWatch agent configuration for the workload in AWS Systems Manager Parameter Store. Create a Systems Manager document that installs and configures the CloudWatch agent by using the configuration. Create an Amazon EventBridge (Amazon CloudWatch Events) rule on the default event bus with a Systems Manager Run Command target that runs the document whenever an instance enters the running state.

Answer

Create an Amazon CloudWatch agent configuration for the workload. Create an AWS Lambda function to install and configure the CloudWatch agent by using AWS Systems Manager Session Manager. Include the agent configuration inside the Lambda package. Create an AWS Config custom rule to identify changes to the EC2 instances and invoke Lambda function.

Answer

Create an Amazon CloudWatch agent configuration for the workload. Save the CloudWatch agent configuration as part of an AWS Lambda deployment package. Use AWS CloudTrail to capture EC2 tagging events and initiate agent installation.Use AWS CodeBuild to configure the CloudWatch agent on the instances that run the workload.

Question 25

A Solutions Architect is designing a highly available and reliable solution for a cluster of Amazon EC2 instances. The Solutions Architect must ensure that any EC2 instance within the cluster recovers automatically after a system failure. The solution must ensure that the recovered instance maintains the same IP address.How can these requirements be met?

Accepted Answer

Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric, and then configure an EC2 action to recover the instance.

Answer

Create an AWS Lambda script to restart any EC2 instances that shut down unexpectedly.

Answer

Create an Auto Scaling group for each EC2 instance that has a minimum and maximum size of 1.

Answer

Create a new t2.micro instance to monitor the cluster instances. Configure the t2.micro instance to issue an aws ec2 reboot-instances command upon failure.

Question 26

A bank is designing an online customer service portal where customers can chat with customer service agents. The portal is required to maintain a 15-minute RPO or RTO in case of a regional disaster. Banking regulations require that all customer service chat transcripts must be preserved on durable storage for at least 7 years, chat conversations must be encrypted inflight, and transcripts must be encrypted at rest. The Data Loss Prevention team requires that data at rest must be encrypted using a key that the team controls, rotates, and revokes.Which design meets these requirements?

Accepted Answer

The chat application logs each chat message into Amazon CloudWatch Logs. The CloudWatch Logs group is configured to export logs into an Amazon Glacier vault with a 7-year vault lock policy. Glacier cross-region replication mirrors chat archives to the backup region. Separate AWS KMS keys are specified for the CloudWatch Logs group and the Amazon Glacier vault.

Answer

The chat application logs each chat message into Amazon CloudWatch Logs. A scheduled AWS Lambda function invokes a CloudWatch Logs CreateExportTask every 5 minutes to export chat transcripts to Amazon S3. The S3 bucket is configured for cross-region replication to the backup region. Separate AWS KMS keys are specified for the CloudWatch Logs group and the S3 bucket.

Answer

The chat application logs each chat message into two different Amazon CloudWatch Logs groups in two different regions, with the same AWS KMS key applied. Both CloudWatch Logs groups are configured to export logs into an Amazon Glacier vault with a 7-year vault lock policy with a KMS key specified.

Answer

The chat application logs each chat message into Amazon CloudWatch Logs. A subscription filter on the CloudWatch Logs group feeds into an Amazon Kinesis Data Firehose which streams the chat messages into an Amazon S3 bucket in the backup region. Separate AWS KMS keys are specified for the CloudWatch Logs group and the Kinesis Data Firehose.

Question 27

How can multiple compute resources be used on the same pipeline in AWS Data Pipeline?

Accepted Answer

You can use multiple compute resources on the same pipeline by defining multiple cluster objects in your definition file and associating the cluster to use for each activity via its runs On field.

Answer

You can use multiple compute resources on the same pipeline by defining multiple cluster definition files

Answer

You can use multiple compute resources on the same pipeline by defining multiple clusters for your activity.

Answer

You cannot use multiple compute resources on the same pipeline.

Question 28

A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 in this VPC. The user is trying to create another subnet with the same VPC for CIDR 20.0.0.1/24. What will happen in this scenario?

Accepted Answer

It will throw a CIDR overlaps error

Answer

The VPC will modify the first subnet CIDR automatically to allow the second subnet IP range

Answer

The second subnet will be created

Answer

It is not possible to create a subnet with the same CIDR as VPC

Question 29

A company is using an Amazon EMR cluster to run its big data jobs. The cluster’s jobs are invoked by AWS Step Functions Express Workflows that consume various Amazon Simple Queue Service (Amazon SQS) queues. The workload of this solution is variable and unpredictable. Amazon CloudWatch metrics show that the cluster's peak utilization is only 25% at times and that the cluster sits idle the rest of the time. A solutions architect must optimize the costs of the cluster without negatively impacting the time it takes to run the various jobs. What is the MOST cost-effective solution that meets these requirements?

Accepted Answer

Modify the EMR cluster to use capacity-optimized Spot Instances and a diversified task fleet. Define target capacity for each node type with a mix of On-Demand Instances and Spot Instances.

Answer

Modify the EMR cluster by turning on automatic scaling of the core nodes and task nodes with a custom policy that is based on cluster utilization. Purchase Reserved Instance capacity to cover the master node.

Answer

Modify the EMR cluster to use an instance fleet of Dedicated On-Demand Instances for the master node and core nodes, and to use Spot Instances for the task nodes. Define target capacity for each node type to cover the load.

Answer

Purchase Reserved Instances for the master node and core nodes. Terminate all existing task nodes in the EMR cluster.

Question 30

A solutions architect needs to migrate 50 TB of NFS data to Amazon S3. The files are on several NFS file servers on corporate network. These are dense file systems containing tens of millions of small files. The system operators have configured the file interface on an AWS Snowball Edge device and are using a shell script to copy data. Developers report that copying the data to the Snowball Edge device is very slow. The solutions architect suspects this may be related to the overhead of encrypting all the small files and transporting them over the network. Which changes can be made to speed up the data transfer?

Accepted Answer

Change the solution to use the S3 Adapter instead of the file interface on the Snowball Edge device.

Answer

Cluster two Snowball Edge devices together to increase the throughput of the devices.

Answer

Increase the number of parallel copy jobs to increase the throughput of the Snowball Edge device.

Answer

Connect directly to the USB interface on the Snowball Edge device and copy the files locally.

Question 31

To scale out the AWS resources using manual AutoScaling, which of the below mentioned parameters should the user change?

Accepted Answer

Desired capacity

Answer

Current capacity

Answer

Preferred capacity

Answer

Maximum capacity

Question 32

Select the correct statement about Amazon ElastiCache.

Accepted Answer

It makes it easy to set up, manage, and scale a distributed in-memory cache environment in the cloud.

Answer

It allows you to quickly deploy your cache environment only if you install software.

Answer

It does not integrate with other Amazon Web Services.

Answer

It cannot run in the Amazon Virtual Private Cloud (Amazon VPC) environment.

Question 33

An organization has a write-intensive mobile application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application has scaled well, however, costs have increased exponentially because of higher than anticipated Lambda costs. The application’s use is unpredictable, but there has been a steady 20% increase in utilization every month. While monitoring the current Lambda functions, the Solutions Architect notices that the execution-time averages 4.5 minutes. Most of the wait time is the result of a high-latency network call to a 3-TB MySQL database server that is on-premises. A VPN is used to connect to the VPC, so the Lambda functions have been configured with a five-minute timeout. How can the Solutions Architect reduce the cost of the current architecture?

Accepted Answer

Replace the VPN with AWS Direct Connect to reduce the network latency to the on-premises MySQL database. Enable local caching in the mobile application to reduce the Lambda function invocation calls.Monitor the Lambda function performance; gradually adjust the timeout and memory properties to lower values while maintaining an acceptable execution time. Offload the frequently accessed records from DynamoDB to Amazon ElastiCache.

Answer

Replace the VPN with AWS Direct Connect to reduce the network latency to the on-premises MySQL database. Cache the API Gateway results to Amazon CloudFront.Use Amazon EC2 Reserved Instances instead of Lambda.Enable Auto Scaling on EC2, and use Spot Instances during peak times. Enable DynamoDB Auto Scaling to manage target utilization.

Answer

Migrate the MySQL database server into a Multi-AZ Amazon RDS for MySQL.Enable caching of the Amazon API Gateway results in Amazon CloudFront to reduce the number of Lambda function invocations. Monitor the Lambda function performance; gradually adjust the timeout and memory properties to lower values while maintaining an acceptable execution time. Enable DynamoDB Accelerator for frequently accessed records, and enable the DynamoDB Auto Scaling feature.

Answer

Migrate the MySQL database server into a Multi-AZ Amazon RDS for MySQL.Enable API caching on API Gateway to reduce the number of Lambda function invocations.Continue to monitor the AWS Lambda function performance; gradually adjust the timeout and memory properties to lower values while maintaining an acceptable execution time. Enable Auto Scaling in DynamoDB.

Question 34

A company currently runs a secure application on Amazon EC2 that takes files from on-premises locations through AWS Direct Connect, processes them, and uploads them to a single Amazon S3 bucket. The application uses HTTPS for encryption in transit to Amazon S3, and S3 server-side encryption to encrypt at rest.Which of the following changes should the Solutions Architect recommend to make this solution more secure without impeding application’s performance?

Accepted Answer

Add a VPC endpoint. Configure endpoint policies on the VPC endpoint to allow access to the required S3 buckets only. Implement an S3 bucket policy that allows communication from the VPC endpoint only.

Answer

Add a NAT gateway. Update the security groups on the EC2 instance to allow access to and from the S3 IP range only. Configure an S3 bucket policy that allows communication from the NAT gateway’s Elastic IP address only.

Answer

Add a VPC endpoint. Configure endpoint policies on the VPC endpoint to allow access to the required Amazon S3 buckets only. Implement an S3 bucket policy that allows communication from the VPC’s source IP range only.

Answer

Add a NAT gateway. Update the security groups on the EC2 instance to allow access to and from the S3 IP range only. Configure an S3 bucket policy that allows communication from the source public IP address of the on-premises network only.

Question 35

A company is building a sensor data collection pipeline in which thousands of sensors write data to an Amazon Simple Queue Service (Amazon SQS) queue every minute. The queue is processed by an AWS Lambda function that extracts a standard set of metrics from the sensor data. The company wants to send the data to Amazon CloudWatch. The solution should allow for viewing individual and aggregate sensor metrics and interactively querying the sensor log data using CloudWatch Logs Insights.What is the MOST cost-effective solution that meets these requirements?

Accepted Answer

Write the processed data to CloudWatch Logs in a structured format. Create a CloudWatch metric filter to parse the logs and publish the metrics to CloudWatch with dimensions to uniquely identify a sensor.

Answer

Write the processed data to CloudWatch Logs in the CloudWatch embedded metric format.

Answer

Write the processed data to CloudWatch Logs. Then write the data to CloudWatch by using the PutMetricData API call.

Answer

Configure the CloudWatch Logs agent for AWS Lambda. Output the metrics for each sensor in statsd format with tags to uniquely identify a sensor. Write the processed data to CloudWatch Logs.

Question 36

A Solutions Architect is designing a network solution for a company that has applications running in a data center in Northern Virginia. The applications in the company’s data center require predictable performance to applications running in a virtual private cloud (VPC) located in us-east-1, and a secondary VPC in us-west-2 within the same account. The company data center is collocated in an AWS Direct Connect facility that serves the us-east-1 region. The company has already ordered an AWS Direct Connect connection and a cross-connect has been established.Which solution will meet the requirements at the LOWEST cost?

Accepted Answer

Provision a Direct Connect gateway and attach the virtual private gateway (VGW) for the VPC in us-east-1 and the VGW for the VPC in us-west-2. Create a private VIF on the Direct Connect connection and associate it to the Direct Connect gateway.

Answer

Create private VIFs on the Direct Connect connection for each of the company’s VPCs in the us-east-1 and us-west-2 regions. Configure the company’s data center router to connect directly with the VPCs in those regions via the private VIFs.

Answer

Deploy a transit VPC solution using Amazon EC2-based router instances in the us-east-1 region. Establish IPsec VPN tunnels between the transit routers and virtual private gateways (VGWs) located in the us-east-1 and us-west-2 regions, which are attached to the company’s VPCs in those regions. Create a public VIF on the Direct Connect connection and establish IPsec VPN tunnels over the public VIF between the transit routers and the company’s data center router.

Answer

Order a second Direct Connect connection to a Direct Connect facility with connectivity to the us-west-2 region. Work with a partner to establish a network extension link over dark fiber from the Direct Connect facility to the company’s data center.Establish private VIFs on the Direct Connect connections for each of the company’s VPCs in the respective regions. Configure the company’s data center router to connect directly with the VPCs in those regions via the private VIFs.

Question 37

An organization is setting a website on the AWS VPC. The organization has blocked a few IPs to avoid a D-DOS attack. How can the organization configure that a request from the above mentioned IPs does not access the application instances?

Accepted Answer

Configure an ACL at the subnet which denies the traffic from that IP address.

Answer

Create an IAM policy for VPC which has a condition to disallow traffic from that IP address.

Answer

Configure a security group at the subnet level which denies traffic from the selected IP.

Answer

Configure the security group with the EC2 instance which denies access from that IP address.

Question 38

A solutions architect is designing a solution to connect a company’s on-premises network with all the company’s current and future VPCs on AWS. The company is running VPCs in five different AWS Regions and has at least 15 VPCs in each Region.The company’s AWS usage is constantly increasing and will continue to grow. Additionally, all the VPCs throughout all five Regions must be able to communicate with each other. The solution must maximize scalability and ease of management.Which solution meets these requirements?

Accepted Answer

Create an AWS CloudFormation template for a redundant AWS Site-to-Site VPN tunnel to the on-premises network. Deploy the CloudFormation template for each VPC. Set up VPC peering between all the VPCs for VPC-to-VPC communication.

Answer

Set up a transit gateway in each Region. Establish a redundant AWS Site-to-Site VPN connection between the onpremises firewalls and the transit gateway in the Region that is closest to the onpremises network. Peer all the transit gateways with each other. Connect all the VPCs to the transit gateway in their Region.

Answer

Set up a transit gateway in each Region. Establish a redundant AWS Site-to-Site VPN connection between the onpremises firewalls and each transit gateway. Route traffic between the different Regions through the company’s on-premises firewalls. Connect all the VPCs to the transit gateway in their Region.

Answer

Create an AWS CloudFormation template for a redundant AWS Site-to-Site VPN tunnel to the on-premises network. Deploy the CloudFormation template for each VPC. Route traffic between the different Regions through the company’s onpremises firewalls.

Question 39

Which statement is NOT true about accessing remote AWS region in the US by your AWS Direct Connect which is located in the US?

Accepted Answer

Any data transfer out of a remote region is billed at the location of your AWS Direct Connect data transfer rate.

Answer

AWS Direct Connect locations in the United States can access public resources in any US region.

Answer

You can use a single AWS Direct Connect connection to build multi-region services.

Answer

To connect to a VPC in a remote region, you can use a virtual private network (VPN) connection over your public virtual interface.

Question 40

You are setting up some EBS volumes for a customer who has requested a setup which includes a RAID (redundant array of inexpensive disks). AWS has some recommendations for RAID setups. Which RAID setup is not recommended for Amazon EBS?

Accepted Answer

RAID 5 and RAID 6

Answer

RAID 1 only

Answer

RAID 5 only

Answer

RAID 0 only

Amazon SAP-C01 Practice Test 6

Amazon SAP-C01 Practice Tests

Amazon SAP-C01 Practice Test 6

Question

Amazon SAP-C01 Practice Tests

Practice Tests