Online Good AWS SAA-C02 Exam Free Questions

dumps2021-12-20T09:16:37+08:00

AWS certification SAA-C02 exam is a related test for AWS Certified Solutions Architect-Associate certification. There are 65 questions in real AWS certification SAA-C02 exam, and you have 130 minutes to complete all the questions. The SAA-C02 exam registration fee is $150 ( practice exam: $20). We provide free online AWS certification SAA-C02 exam questions for you practice below.

Page 1 of 7

1. A company operates a website on Amazon EC2 Linux instances Some of the instances are failing. Troubleshooting points to insufficient swap space on the failed instances. The operations team lead needs a solution to monitor this.

What should a solutions architect recommend?

Configure an Amazon CloudWatch SwapUsage metric dimension Monitor the SwapUsage dimension in the EC2 metrics in CloudWatch.

Use EC2 metadata to collect information, then publish it to Amazon CloudWatch custom metrics Monitor SwapUsage metrics in CloudWatch

Install an Amazon CloudWatch agent on the instances. Run an appropriate script on a set schedule. Monitor SwapUtilization metrics in CloudWatch

Enable detailed monitoring in the EC2 console Create an Amazon CloudWatch SwapUtilization custom metric Monitor SwapUtilization metrics in CloudWatch

2. A company's application is running on Amazon EC2 instances within an Auto Scaling group behind an Elastic Load Balancer Based on the application's history the company anticipates a spike in traffic during a holiday each year A solutions architect must design a strategy to ensure that the Auto Scaling group proactively increases capacity to minimize any performance impact on application users.

Which solution will meet these requirements'?

Create an Amazon CloudWatch alarm to scale up the EC2 instances when CPU utilization exceeds 90%

Create a recurring scheduled action to scale up the Auto Scaling group before the expected period of peak demand

Increase the minimum and maximum number of EC2 instances in the Auto Scaling group during the peak demand period

Configure an Amazon Simple Notification Service (Amazon SNS) notification to send alerts when there are autoscaling EC2_INSTANCE_LAUNCH events

3. A company is planning to migrate a legacy application to AWS. The application currently uses NFS to communicate to an on-premises storage solution to store application data. The application cannot be modified to use any other communication protocols other than NFS for this purpose

Which storage solution should a solutions architect recommend for use after the migration?

AWS Data Sync

Amazon Elastic Block Store (Amazon EBS>

Amazon Elastic File System (Amazon EFS)

Amazon EMR File System (Amazon EMRFS)

4. A company is migrating Us applications to AWS Currently applications that run on premises generate hundreds of terabytes of data that is stored on a shared file system. The company Is running an analytics application in the cloud that runs hourly to generate Insights from this data . The company needs a solution to handle the ongoing data transfer between the on-premises shared file system and Amazon S3. The solution also must be able to handle occasional interruptions m internet connectivity

Which solution should the company use for the data transfer to meet these requirements?

AWS DataSync

AWS Migration Hub

AWS Snowball Edge Storage Optimized

AWS Transfer for SFTP

5. A company uses Amazon S3 to store its confidential audit documents. The S3 bucket uses

bucket policies to restrict access to audit team IAM user credentials according to the principle of least privilege Company managers are wonted about accidental deletion of documents in the S3 bucket and want a more secure solution

What should a solutions architect do to secure the audit documents?

Enable the versioning and MFA Delete features on the S3 bucket.

Enable multi-factor authentication (UFA) on the 1AM user credentials for each audit team 1AM user account.

Add an S3 Lifecycle policy to the audit team's IAM user accounts to deny the s3 DekaeObject action during audit dates

Use AWS Key Management Service (AWS KMS) to encrypt the S3 bucket and restrict audit learn IAM user accounts from accessing the KMS key.

6. A company is developing a real-time multiplayer game that uses UDP for communications between the client and servers In an Auto Scaling group Spikes in demand are anticipated during the day, so the game server platform must adapt accordingly Developers want to store gamer scores and other non-relational data in a database solution that will scale without intervention

Which solution should a solutions architect recommend?

Use Amazon Route 53 for traffic distribution and Amazon Aurora Serverless for data storage

Use a Network Load Balancer for traffic distribution and Amazon DynamoDB on-demand for data storage

Use a Network Load Balancer for traffic distribution and Amazon Aurora Global Database for data storage

Use an Application Load Balancer for traffic distribution and Amazon DynamoDB global tables for data storage

7. A company recently launched Linux-based application instances on Amazon EC2 in a private subnet and launched a Linux-based bastion host on an Amazon EC2 instance in a public subnet of a VPC A solutions architect needs to connect from the on-premises

network, through the company's internet connection to the bastion host and to the application servers. The solutions architect must make sure that the security groups of all the EC2 instances will allow that access

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO)

Replace the current security group of the bastion host with one that only allows inbound access from the application instances

Replace the current security group of the bastion host with one that only allows inbound access from the internal IP range for the company

Replace the current security group of the bastion host with one that only allows inbound access from the external IP range for the company

Replace the current security group of the application instances with one that allows inbound SSH access from only the private IP address of the bastion host

Replace the current security group of the application instances with one that allows inbound SSH access from only the public IP address of the bastion host

8. A company runs a web application that is backed by Amazon RDS. A new database administrator caused data loss by accidentally editing information in a database table To help recover from this type of incident, the company wants the ability to restore the database to its state from 5 minutes before any change within the last 30 days.

Which feature should the solutions architect include in the design to meet this requirement?

Read replicas

Manual snapshots

Automated backups

Multi-AZ deployments

9. An Amazon EC2 administrator created the following policy associated with an IAM group containing several users

What is the effect of this policy?

Users can terminate an EC2 instance in any AWS Region except us-east-1.

Users can terminate an EC2 instance with the IP address 10 100 100 1 in the us-east-1 Region

Users can terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100.100.254.

Users cannot terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100 100 254

10. A company runs an application In a branch office within a small data closet with no vitalized compute resources. The application data is stored on an NFS volume Compliance standards require a daily offsite backup of the NFS volume.

Which solution meets these requirements?

Install an AWS Storage Gateway fie gateway on premises to replicate the data to Amazon S3

Install an AWS Storage Gateway fie gateway hardware appliance on premises to replicate the data to Amazon S3.

Install an AWS Storage Gateway volume gateway with stored volumes on premises to replicate the data to Amazon S3

Install an AWS Storage Gateway volume gateway with cached volumes on premises to replicate the data to Amazon S3.

11. A company previously migrated its data warehouse solution to AWS. The company also has an AWS Direct Conned connection Corporate office users query the data warehouse using a visualization tool. The average size of a query returned by the data warehouse is 50 MB and each webpage sent by the visualization tool is approximately 500 KB Result sets returned by the data warehouse are not cached

Which solution provides the LOWEST data transfer egress cost for the company?

Host the visualization tool on premises and query the data warehouse directly over the internet

Host the visualization tool m the same AWS Region as the data warehouse Access it over the internet

Host the visualization tool on premises and query me data warehouse directly over a Direct Conned connection at a location in the same AWS Region

Host the visualization tool in the same AWS Region as the data warehouse and access it over a Direct Conned connection at a location in the same Region

12. A company runs an application using Amazon ECS. The application creates resized versions of an original Image and then makes Amazon S3 API calls to store the resized images in Amazon S3

How can a solutions architect ensure that the application has permission to access Amazon S3?

Update the S3 role in AWS 1AM to allow read/write access from Amazon ECS and then relaunch the container.

Create an 1AM role with S3 permissions and then specify that role as the taskRoleArn in the task definition.

Create a security group that allows access from Amazon ECS to Amazon S3 and update the launch configuration used by the ECS cluster.

Create an 1AM user with S3 permissions, and then relaunch the Amazon EC2 instances for the ECS cluster while logged in as this account.

13. A company hosts an application on AWS. The application interacts with an Amazon DynamoDB table that has 10 read capacity units (RCUs) Data from Amazon CloudWatch alarms shows that throttling is occurring on read requests to the DynamoDB table. The company needs to prevent this issue from happening in the future as the application continues to grow.

What should a solutions architect recommend to meet these requirements?

Add an Elastic Load Balancer in front of the DynamoDB table.

Change the RCUs for the DynamoDB table to 20.

Provision 20 write capacity units (WCUs) for the DynamoDB table to offset the throttling on read requests.

Enable auto scaling for the DynamoDB table

14. A company is running a publicly accessible serverless application that uses Amazon API Gateway and AWS Lambda. The application’s traffic recently spiked due to fraudulent requests from botnets.

Which steps should a solutions architect take to block requests from unauthorized users? (Select TWO.)

Create a usage plan with an API key that it shared with genuine users only.

Integrate logic within the Lambda function to ignore the requests lion- fraudulent IP addresses

Implement an AWS WAF rule to target malicious requests and trigger actions to filler them out

Convert the existing public API to a private API Update the DNS records to redirect users to the new API endpoint

Create an IAM role tor each user attempting to access the API A user will assume the role when making the API call

15. A company has a mobile chat application with a data store based in Amazon DynamoDB. Users would like new messages to be need with as little latency as possible. A possible architect needs design an optimal solution that requires minimal application changes.

Which method should the solution architect select?

Configure amazon DynamoDB Accelerator (DAX) for the new messages table. Update the code to use DAX endpoint.

AddDynamoDB read replicas to handle the increased read lead the application to point to the read endpoint for the read replicas.

Double the number of read capacity units for the new messages table in DynamoD

Continue to use the existing DynamoDB endpoint.

Add an Amazon ElastiCache for Redis cache to the application stack. Update the application to point to the Redis cache endpoint of DynamoD

16. A company hosts an application on multiple Amazon EC2 instances. The application processes messages from an Amazon SQS queue writes to an Amazon RDS table and deletes the message from the queue Occasional duplicate records are found in the RDS table. The SQS queue does not contain any duplicate messages.

What should a solutions architect do to ensure messages are being processed once only?

Use the CreateQueue API call to create a new queue

Use the Add Permission API call to add appropriate permissions

Use the ReceiveMessage API call to set an appropriate wail time

Use the ChangeMessageVisibility APi call to increase the visibility timeout

17. A company is running an application on AWS to process weather sensor data that is stored in an Amazon S3 bucket. Three batch jobs run hourly to process the data in the S3 bucket for different purposes. The company wants to reduce the overall processing time by running. The three applications in parallel using an event-based approach.

What should a solutions architect do to meet these requirements?

Enable S3 Event Notifications for new objects to an Amazon Simple Queue Service (Amazon SOS) FIFO queue Subscribe al applications to the queue for processing.

Enable S3 Event Notifications for new objects to an Amazon Simple Queue Service (Amazon SOS) standard queue Create an additional SOS queue for all applications, and subscribe all applications to the meal queue for processing.

Enable S3 Event Notifications for new objects to separate Amazon Simple Queue Service (Amazon SOS) FIFO queues Create an additional SOS queue (or each application and subscribe each queue to the initial topic for processing

Enable S3 Event Notifications tor new objects to an Amazon Simple Notification Service (Amazon SNS) topic. Create an Amazon Simple Queue Service (Amazon SOS) queue for each application, and subscribe each queue to the topic for processing

18. A company's web application is running on Amazon EC2 instances behind an application Load Balancer. The company changed its policy., which now requires the application to be accessed from one specific country only.

Which configuration will meet this requirement?

Configure the security group for the EC2 Instances

Configure the security group on the Application Load Balancer

Configure AWS WAF on the Application Load Balancer in a VPC

Configure the network ACL for the subnet that contains the EC2 instances

19. An application uses an Amazon RDS MySQL DB instance. The RDS database is becoming low on disk space A solutions architect wants to increase the disk space without downtime.

Which solution meets these requirements with the LEAST amount of effort?

Enable storage autoscaling in RDS

Increase the RDS database instance size

Change the RDS database instance storage type to Provisioned lOPS

Back up the RDS database increase the storage capacity restore the database and stop the previous instance

20. A company has hired an external vendor to perform work in the company's AWS account . The vendor uses an automated tool that is hosted in an AWS account that the vendor owns . The vendor does not have 1AM access to the company's AWS account

How should a solutions architect grant this access to the vendor?

Create an lAM rote in the company's account to delegate access to the vendor's 1AM role Attach the appropriate 1AM policies to the role for the permissions that the vendor requires

Create an lAM user in the company's account with a password that meets the password complexity requirements Attach the appropriate lAM policies to the user (or the permissions that the vendor requires

Create an IAM group in the company's account Add the tool's lAM user from the vendor account lo the group Attach the appropriate lAM policies to the group for the permissions that the vendor requires

Create a new identity provider by choosing "AWS account" as the provider type in the 1AM console Supply the vendor's AWS account ID and user name Attach the appropriate 1AM policies to the new provider for the permissions that the vendor requires

Page 2 of 7

21. A company is concerned about the security of its public web application due to recent web attacks. The application uses an Application Load Balancer (ALB). A solutions architect must reduce the risk of DDoS attacks against the application

What should the solutions architect do to meet this requirement?

Add an Amazon Inspector agent to the ALB

Configure Amazon Made to prevent attacks.

Enable AWS Shield Advanced to prevent attacks.

Configure Amazon GuardDuty to monitor the ALB

22. A company has developed a new content-sharing application that runs on Amazon Elastic Container Service (Amazon ECS). The application runs on Amazon Linux Docker tasks that use the Amazon EC2 launch type.

The application requires a storage solution that has the following characteristics:

• Accessibility (or multiple ECS tasks through bind mounts

• Resiliency across Availability Zones

• Burslable throughput of up to 3 Gbps

• Ability to be scaled up over time

Which storage solution meets these requirements?

Launch an Amazon FSx for Windows File Server Multi-AZ instance. Configure the ECS task definitions to mount the Amazon FSx instance volume at launch.

Launch an Amazon Elastic File System (Amazon EFS) instance. Configure the ECS task definitions to mount the EFS Instance volume at launch.

Create a Provisioned IOPS SSD (io2) Amazon Elastic Block Store (Amazon EBS) volume with Multi-Attach set to enabled. Attach the EBS volume to the ECS EC2 instance Configure ECS task definitions to mount the EBS instance volume at launch.

Launch an EC2 instance with several Provisioned IOPS SSD (k>2) Amazon Elastic Block Store (Amazon EBS) volumes attached m a RAID 0 configuration. Configure the EC2 instance as an NFS storage server. Configure ECS task definitions to mount the volumes at launch.

23. A solutions architect must design a database solution for a high-traffic ecommerce web application. The database stores customer profiles and shopping cart information. The database must support a peak load of several million requests each second and deliver responses in milliseconds. The operational overhead for managing and scaling the database must be minimized

Which database solution should the solutions architect recommend?

Amazon Aurora

Amazon DynamoDB

Amazon RDS

Amazon Redshift

24. A company has an automobile sales website that stores its listings m a database on Amazon RDS When an automobile is sold the listing needs to be removed from the website and the data must be sent to multiple target systems.

Which design should a solutions architect recommend?

Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS> queue for the targets to consume

Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS) FIFO queue for the targets to consume

Subscribe to an RDS event notification and send an Amazon Simple Queue Service (Amazon SQS) queue fanned out to multiple Amazon Simple Notification Service (Amazon SNS) topics Use AWS Lambda functions to update the targets

Subscribe to an RDS event notification and send an Amazon Simple Notification Service (Amazon SNS) topic fanned out to multiple Amazon Simple Queue Service (Amazon SQS) queues Use AWS Lambda functions to update the targets

25. A company has an Amazon S3 bucket that contains confidential information in its production AWS account. The company has turned on AWS CloudTrail for the account. The

account sends a copy of its logs to Amazon CloudWatch Logs. The company has configured the S3 bucket to log read and write data events.

A company auditor discovers that some objects in the S3 bucket have been deleted A solutions architect must provide the auditor with information about who deleted the objects

What should the solutions architect do to provide this information?

Create a CloudWatch Logs fitter to extract the S3 write API calls against the S3 bucket

Query the CloudTrail togs with Amazon Athena to identify the S3 write API calls against the S3 bucket

Use AWS Trusted Advisor to perform security checks for S3 writ© API calls that deleted the content

Use AWS Config to track configuration changes on the S3 bucket Use these details to track the S3 write API calls that deleted the content

26. A company has data stored in an on-premises data center that is used by several on-premises applications. The company wants to maintain its existing application environment and be able to use AWS services for data analytics and future visualizations

Which storage service should a solutions architect recommend?

Amazon Redshift

AWS Storage Gateway for files

Amazon Elastic Block Store (Amazon EBS)

Amazon Elastic File System (Amazon EFS)

27. A company's facility has badge readers at every entrance throughout the building. When badges are scanned, the readers send a message over HTTPS to indicate who attempted to access that particular entrance.

A solutions architect must design a system to process these messages from the sensors. The solution must be highly available, and the results must be made available for the company's security team to analyze.

Which system architecture should the solutions architect recommend?

Launch an Amazon EC2 instance to serve as the HTTPS endpoint and to process the messages Configure the EC2 instance to save the results to an Amazon S3 bucket.

Create an HTTPS endpoint in Amazon API Gateway. Configure the API Gateway endpoint to invoke an AWS Lambda function to process the messages and save the results to an Amazon DynamoDB table.

Use Amazon Route 53 to direct incoming sensor messages to an AWS Lambda function. Configure the Lambda function to process the messages and save the results to an Amazon DynamoDB table.

Create a gateway VPC endpoint for Amazon S3. Configure a Site-to-Site VPN connection from the facility network to the VPC so that sensor data can be written directly to an S3 bucket by way of the VPC endpoint

28. A monolithic application was recently migrated to AWS and is now running on a single Amazon EC2 instance Due to application limitations it is not possible to use automatic scaling to scale out the application. The chief technology officer (CTO) wants an automated solution to restore the EC2 instance in the unlikely event the underlying hardware fails

What would allow foe automatic recovery of the EC2 instance as quickly as possible?

Configure an Amazon CloudWatch alarm that triggers the recovery of the EC2 instance if it becomes impaired

Configure an Amazon CloudWatch alarm to trigger an SNS message that alerts the CTO when the EC2 instance is impaired

Configure AWS CloudTrail to monitor the health of the EC2 instance, and if it becomes impaired trigger instance recovery

Configure an Amazon EventBridge event to trigger an AWS Lambda function once an hour that checks the health of the EC2 instance and triggers instance recovery if the EC2 instance is unhealthy

29. A company is creating an architecture for a mobile app that requires minimal latency for its users. The company's architecture consists of Amazon EC2 instances behind an Application Load Balancer running in an Auto Seating group. The EC2 instances connect to Amazon RDS Application beta testing showed there was a slowdown when reading the data However, the metrics indicate that the EC2 instances do not cross any CPU utilization thresholds

How can this issue be addressed?

Reduce the threshold for CPU utilization in the Auto Scaling group

Replace the Application Load Balancer with a Network Load Balancer.

Add read replicas for the RDS instances and direct read traffic to the replica

Add Multi-AZ support to the RDS instances and direct read traffic to the new EC2 instance

30. A company has NFS servers in an on-premises data center that need to periodically back up small amounts of data to Amazon S3.

Which solution marts these requirement and is MOST cost-effective?

Set up AWS Glue lo copy the data from the on-premises servers to Amazon S3.

Set up an AWS DataSync agent on Vie on-premises servers, and sync the data lo Amazon S3

Set up an SFTP sync using AWS Transfer for SFTP lo sync data from on premises lo Amazon S3

Set up an AWS Direct Connect connection between the on-premises data center and a VPC, and copy the data to Amazon S3

31. A company has three AWS accounts Management Development and Production. These accounts use AWS services only in the us-east-1 Region All accounts have a VPC with VPC Flow Logs configured to publish data to an Amazon S3 bucket in each separate account For compliance reasons the company needs an ongoing method to aggregate all the VPC flow logs across all accounts into one destination S3 bucket in the Management account.

What should a solutions architect do to meet these requirements with the LEAST operational overhead?

Add S3 Same-Region Replication rules in each S3 bucket that stores VPC flow logs to replicate objects to the destination S3 bucket Configure the destination S3 bucket to allow objects to be received from the S3 buckets in other accounts

Set up an 1AM user in the Management account Grant permissions to the 1AM user to access the S3 buckets that contain the VPC flow logs Run the aws s3 sync command in the AWS CLl to copy the objects to the destination S3 bucket

Use an S3 inventory report to specify which objects in the S3 buckets to copy Perform an S3 batch operation to copy the objects into the destination S3 bucket in the Management account with a single request.

Create an AWS Lambda function in the Management account Grant S3 GET permissions on the source S3 buckets Grant S3 PUT permissions on the destination S3 bucket Configure the function to invoke when objects are loaded in the source S3 buckets

32. A company has two VPCs named Management and Production. The Management VPC uses VPNs through a customer gateway to connect to a single device in the data center. The Production VPC uses a virtual private gateway with two attached AWS Direct Connect connections. The Management and Production VPCs both use a single VPC peering connection to allow communication between the applications.

What should a solutions architect do to mitigate any single point of failure in this architecture?

Add a set of VPNs between the Management and Production VPCs

Add a second virtual private gateway and attach it to the Management VP

Add a second set of VPNs to the Management VPC from a second customer gateway device

Add a second VPC peering connection between the Management VPC and the Production VP

33. A company's website hosted on Amazon EC2 instances processes classified data stored in Amazon S3. Due to security concerns, the company requires a private and secure connection between its EC2 resources and Amazon S3.

Which solution meets these requirements?

Set up S3 bucket policies to allow access from a VPC endpoint

Set up an IAM policy to grant read-write access to the S3 bucket,

Set up a NAT gateway to access resources outside the private subnet

Set up an access key ID and a secret access key to access the S3 bucket

34. A solutions architect is designing a security solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls Because the individual developers will have AWS account root user-level access to their own accounts, the solutions architect wants to ensure that the mandatory AWS CloudTrail configuration that is applied to new developer accounts is not modified.

Which action meets these requirements?

Create an IAM policy that prohibits changes to CloudTrail, and attach it to the root user

Create a new trail in CloudTrail from within the developer accounts with the organization trails option enabled.

Create a service control policy (SCP) the prohibits changes to CloudTrail, and attach it the developer accounts

Create a service-linked role for CloudTrail with a policy condition that allows changes only from an Amazon Resource Name (ARN) in the master account

35. A company has a large Microsoft SharePoint deployment running on-premises that requires Microsoft Windows shared file storage. The company wants to migrate this workload to the AWS Cloud and is considering various storage options. The storage solution must be highly available and integrated with Active Directory for access control

Which solution will satisfy these requirements?

Configure Amazon EFS storage and set the Active Directory domain for authentication

Create an SMB Me share on an AWS Storage Gateway tile gateway in two Availability Zones

Create an Amazon S3 bucket and configure Microsoft Windows Server to mount it as a volume

Create an Amazon FSx for Windows File Server file system on AWS and set the Active Directory domain for authentication

36. A solutions architect must provide a fully managed replacement for an on-premises solution that allows employees and partners to exchange files. The solution must be easily accessible to employees connecting from on-premises systems, remote employees, and external partners

Which solution meets these requirements?

Use AWS Transfer for SFTP to transfer files into and out of Amazon S3.

Use AWS Snowball Edge for local storage and large-scale data transfers

Use Amazon FSx to store and transfer files to make them available remotely.

Use AWS Storage Gateway to create a volume gateway to store and transfer files to Amazon S3

37. An application runs on Amazon EC2 instances across multiple Availability Zones. The instances run in an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The application performs best when the CPU utilization of the EC2 instances is at or near 40%.

What should a solutions architect do to maintain the desired performance across all instances in the group?

Use a simple scaling policy to dynam

Amazon DynamoDB global tables

Amazon RDS for MySQL with Multi-AZ enabled

Amazon RDS for MySQL with a cross-Region snapshot copy

38. A bicycle sharing company is developing a multi-tier architecture to track the location of its bicycles during peak operating hours. The company wants to use these data points in its existing analytics platform A solutions architect must determine the most viable multi-tier option to support this architecture. The data points must be accessible from the REST API.

Which action meets these requirements for storing and retrieving location data?

Use Amazon Athena with Amazon S3

Use Amazon API Gateway with AWS Lambda

Use Amazon QuickSight with Amazon Redshift.

Use Amazon API Gateway with Amazon Kinesis Data Analytics

39. A developer has a script lo generate daily reports that users previously ran manually. The script consistently completes in under 10 minutes. The developer needs to automate this process in a cost-effective manner.

Which combination of services should the developer use? (Select TWO.)

AWS Lambda

AWS CloudTrail

Cron on an Amazon EC2 instance

Amazon EC2 On-Demand Instance with user data

Amazon EventBridge {Amazon CloudWatch Events)

40. A company has created an isolated backup of its environment in another Region. The application is running in warm standby mode and is fronted by an Application Load Balancer (ALB). The current failover process is manual and requires updating a DNS alias record to point to the secondary ALB in another Region

What should a solutions architect do to automate the failover process?

Enable an ALB health check

Enable an Amazon Route 53 health check

Create a CNAME record on Amazon Route 53 pointing to the ALB endpoint.

Create conditional forwarding rules on Amazon Route 53 pointing to an internal BIND DNS server

Page 3 of 7

41. A solutions architect is designing the storage architecture tor a new web application used for storing and viewing engineering drawings All application components will be deployed on the AWS infrastructure.

The application design must support caching to minimize the amount of time that users wait for the engineering drawings to load. The application must be able to store petabytes of data.

Which combination of storage and caching should the solutions architect use?

Amazon S3 with Amazon CloudFront

Amazon S3 Glacier with Amazon ElastiCache

Amazon Elastic Block Store (Amazon BBS) volumes with Amazon CloudFront

AWS Storage Gateway with Amazon ElastiCache

42. A solution architect is designing he architect of a new application being deployed to the AWS Cloud. The application will run on Amazon EC2 On-Demand instances and will automatically scale across multiple Availability Zones. The EC2 instances will scale up and down frequently the day. An Application load balancer (ALB) will handle the load distribution. The architecture needs to support distributed session data management. The company is willing to make charges to code if needed.

What should the solutions architect do to ensure that the architecture supports distributed session data management?

Use Amazon ElastiCache to manage and store session data.

Use session affinity (sticky sessions) of the ALB to manage session data.

Use Session Manager from AWS Systems Manager to manage the session.

Use the GetSessionToken API operation in AWS Security Token Service (AWS STS) to manage the session.

43. A solutions architect is designing a multi-tier application for a company. The application's users upload images from a mobile device. The application generates a thumbnail of each image and returns a message to the user to confirm that the image was uploaded successfully.

The thumbnail generation can take up to 60 seconds, but the company wants to provide a faster response time to its users to notify them that the original image was received. The solutions architect must design the application to asynchronously dispatch requests to the different application tiers.

What should the solutions architect do to meet these requirements?

Write a custom AWS Lambda function to generate the thumbnail and alert the user. Use the image upload process as an event source to invoke the Lambda function.

Create an AWS Step Functions workflow Configure Step Functions to handle the orchestration between the application tiers and alert the user when thumbnail generation is complete

Create an Amazon Simple Queue Service (Amazon SQS) message queue. As images are uploaded, place a message on the SQS queue for thumbnail generation. Alert the user through an application message that the image was received

Create Amazon Simple Notification Service (Amazon SNS) notification topics and subscriptions Use one subscription with the application to generate the thumbnail after the image upload is complete. Use a second subscription to message the user's mobile app by way of a push notification after thumbnail generation is complete.

44. A company is designing a shared storage solution for a gaming application that is hosted in

the AWS Cloud. The company needs the ability to use SMB clients to access data solution must be fully managed.

Which AWS solution meets these requirements'?

Create an AWS DataSync task that shares the data as a mountable file system Mount the file system to the application server

Create an Amazon EC2 Windows instance Install and configure a Windows file share role on the instance Connect the application server to the file share

Create an Amazon FSx for Windows File Server file system Attach the file system to the origin server Connect the application server to the Me system

Create an Amazon S3 bucket Assign an 1AM role to the application to grant access to the S3 bucket Mount the S3 bucket to the application server

45. Application developers have noticed that a production application is very slow when business reporting users run large production reports against the Amazon RDS instance backing the application. The CPU and memory utilization metrics for the RDS instance do not exceed 60% while the reporting queries are running. The business reporting users must be able to generate reports without affecting the application's performance.

Which action will accomplish this?

Increase the size of the RDS instance

Create a read replica and connect the application to it

Enable multiple Availability Zones on the RDS instance

Create a read replica and connect the business reports to it

46. A company has an application that collects data from loT sensors on automobiles. The data is streamed and stored in Amazon S3 through Amazon Kinesis Date Firehose. The data produces trillions of S3 objects each year. Each morning, the company uses the data from the previous 30 days to retrain a suite of machine learning (ML) models.

Four times each year, the company uses the data from the previous 12 months to perform analysis and train other ML models. The data must be available with minimal delay for up to 1 year. After 1 year, the data must be retained for archival purposes.

Which storage solution meets these requirements MOST cost-effectively?

Use the S3 Intelligent-Tiering storage class. Create an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 1 year

Use the S3 Intelligent-Tiering storage class. Configure S3 Intelligent-Tiering to automatically move objects to S3 Glacier Deep Archive after 1 year.

Use the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Create an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 1 year.

Use the S3 Standard storage class. Create an S3 Lifecycle policy to transition objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days, and then to S3 Glacier Deep Archive after 1 year.

47. A company's legacy application is currently relying on a single-instance Amazon RDS MySQL database without encryption. Due to new compliance requirements all existing and new data in this database must be encrypted.

How should this be accomplished?

Create an Amazon S3 bucket with server-side encryption enabled Move all the data to Amazon S3 Delete the RDS instance

Enable RDS Multi-AZ mode with encryption at rest enabled. Perform a failover to the standby instance to delete the original instance

Take a snapshot of the RDS instance. Create an encrypted copy of the snapshot. Restore the RDS instance from the encrypted snapshot.

Create an RDS read replica with encryption at rest enabled Promote the read replica to master and switch the application over to the new master Delete the old RDS instance

48. A company wants to host a web application on AWS that will communicate to a database within a VPC. The application should be highly available.

What should a solutions architect recommend?

Create two Amazon EC2 instances to host the web servers behind a load balancer and then deploy the database on a large instance

Deploy a load balancer in multiple Availability Zones with an Auto Scaling group for the web servers and then deploy Amazon RDS in multiple Availability Zones

Deploy a load balancer in the public subnet with an Auto Scaling group for the web servers, and then deploy the database on an Amazon EC2 instance in the private subnet

Deploy two web servers with an Auto Scaling group, configure a domain that points to the two web servers, and then deploy a database architecture in multiple Availability Zones

49. A company needs the ability to analyze the log files of its proprietary application. The logs are stored in JSON format in an Amazon S3 bucket Queries will be simple and will run on-demand A solutions architect needs to perform the analysis with minimal changes to the existing architecture

What should the solutions architect do to meet these requirements with the LEAST amount of operational overhead?

Use Amazon Redshift to load all the content into one place and run the SQL queries as needed

Use Amazon CloudWatch Logs to store the logs Run SQL queries as needed from the Amazon CloudWatch console

Use Amazon Athena directly with Amazon S3 to run the queries as needed

Use AWS Glue to catalog the logs Use a transient Apache Spark cluster on Amazon EMR to run the SQL queries as needed

50. A company is designing an internet-facing web application. The application runs on Amazon EC2 for Linux-based instances that store sensitive user data in Amazon RDS MySQL Multi-AZ DB instances. The EC2 instances are in public subnets, and the RDS DB instances are in private subnets. The security team has mandated that the DB instances be secured against web-based attacks.

What should a solutions architect recommend?

Ensure the EC2 instances are part of an Auto Scaling group and are behind an Application Load Balancer Configure the EC2 instance iptables rules to drop suspicious web traffic. Create a security group for the DB instances. Configure the RDS security group to only allow port 3306 inbound from the individual EC2 instances.

Ensure the EC2 instances are part of an Auto Scaling group and are behind an Application Load Balancer. Move DB instances to the same subnets that EC2 instances are located in. Create a security group for the DB instances Configure the RDS security group to only allow port 3306 inbound from the individual EC2 instances.

Ensure the EC2 instances are part of an Auto Scaling group and are behind an Application Load Balancer. Use AWS WAF to monitor inbound web traffic for threats Create a security group for the web application servers and a security group for the DB instances. Configure the RDS security group to only allow port 3306 inbound from the web application server security group

Ensure the EC2 instances are part of an Auto Scaling group and are behind an Application Load Balancer. Use AWS WAF to monitor inbound web traffic for threats Configure the Auto Scaling group to automatically create new DB instances under heavy traffic. Create a security group for the RDS DB instances. Configure the RDS security group to only allow port 3306 inbound.

51. A company is running a multi-tier web application on AWS. The application runs its database on Amazon Aurora MySQL. The application and database tiers are in the us-easily Region.

A database administrator who monitors the Aurora DB cluster finds that an intermittent increase in read traffic is creating high CPU utilization on the read replica. The result is increased read latency for the application. The memory and disk utilization of the DB instance are stable throughout the event of increased latency.

What should a solutions architect do to improve the read scalability?

Reboot the DB cluster

Create a cross-Region read replica

Configure Aurora Auto Scaling for the read replica

Increase the provisioned read IOPS for the DB instance

52. At part of budget planning. management wants a report of AWS billed dams listed by user. The data will be used to create department budgets. A solution architect needs to determine the most efficient way to obtain this report Information

Which solution meets these requirement?

Run a query with Amazon Athena to generate the report.

Create a report in Cost Explorer and download the report

Access the bill details from me tuning dashboard and download Via bill.

Modify a cost budget in AWS Budgets to alert with Amazon Simple Email Service (Amazon SES).

53. Some of the company’s customers are retrieving records frequently, leading to an increase in costs for the company. The company wants to limit retrieved requests in the future. The company also wants to ensure that if one customer reaches its retrieval limit other customers will not affected.

Which solution will meet these requirements?

Set up server-side throttling limits for API Gateway.

Limit DynamoDB read throughput on the table lo an amount that results m the maximum cost that the company is willing to incur.

Set up a usage plan for API Gateway Implement throttling limits tor each customer. and distribute API keys to each customer

Set up AWS Budgets. Monitor the usage of API Gateway and DynamoDB Configure an alarm to provide an alert when the cost exceeds a certain threshold each month

54. A company has a production web application in which users upload documents through a web interlace or a mobile app. According to a new regulatory requirement, new documents cannot be modified or deleted after they are stored.

What should a solutions architect do to meet this requirement?

Store the uploaded documents in an Amazon S3 bucket with S3 Versioning and S3 Object Lock enabled

Store the uploaded documents in an Amazon S3 bucket. Configure an S3 Lifecycle policy to archive the documents periodically.

Store the uploaded documents in an Amazon S3 bucket with S3 Versioning enabled Configure an ACL to restrict all access to read-only.

Store the uploaded documents on an Amazon Elastic File System (Amazon EFS) volume. Access the data by mounting the volume in read-only mode.

55. A company has multiple AWS accounts for various departments. One of the departments wants to share an Amazon S3 bucket with all other departments.

Which solution will require the LEAST amount of effort?

Enable cross-account S3 replication for the bucket

Create a pre-signed URL for the bucket and share it with other departments

Set the S3 bucket policy to allow cross-account access to other departments

Create 1AM users for each of the departments and configure a read-only 1AM policy

56. A company hosts a popular website in the AWS Cloud, A solutions architect needs to provide reports about user click behaviour in near-real time as users navigate the website.

Which solution will meet this requirement?

Store the clickstream data in Amazon DynamoD

Deploy an application that runs on AWS Elastic Beanstalk to process and analyze the data.

Push the clickstream data from each session to an Amazon Kinesis data stream Analyze the dab by using Amazon Kinesis Data Analytics.

Store the clickstream data in an Amazon S3 bucket. Order the data by timestamp Process the data with an AWS Lambda function that is subscribed to object creation events on the S3 bucket.

Forward the clickstream data to Amazon Simple Queue Service (Amazon SOS) Store the data In an Amazon ROS for MySQL DB instance. Deploy Amazon FC2 Instances to process and analyze the data

57. A company is running several business applications in three separate VPCs within the us-east-1 Region. The applications must be able to communicate between VPCs. The applications also must be able to consistently send hundreds of gigabytes of data each day to a latency-sensitive application that runs in a single on-premises data center.

A solutions architect needs to design a network connectivity solution that maximizes cost-effectiveness.

Which solution meets these requirements?

Configure three AWS Site-to-Site VPN connections from the data center to AW

Establish connectivity by configuring one VPN connection for each VP

Launch a third-party virtual network appliance in each VP

Establish an IPsec VPN tunnel between the data center and each virtual appliance.

Set up three AWS Direct Connect connections from the data center to a Direct Connect gateway In us-easl-1. Establish connectivity by configuring each VPC to use one of the Direct Connect connections.

Set up one AWS Direct Connect connection from the data center lo AWS Create a transit gateway, and attach each VPC to the transit gateway. Establish connectivity between the Direct Connect connection and the transit gateway.

58. A social media company allows users to upload images to its website. The website runs on Amazon EC2 instances. During upload requests, the website resizes the images to a standard size and stores the resized images in Amazon S3. Users are experiencing slow upload requests to the website.

The company needs to reduce coupling within the application and improve website performance A solutions architect must design the most operationally efficient process for image uploads

Which combination of actions should the solutions architect take to meet these requirements'? (Select TWO.)

Configure the application to upload images to S3 Glacier.

Configure the web server to upload the original images to Amazon S3.

Configure the application to upload images directly from each user's browser to Amazon S3 through the use of a presigned UR

Configure S3 Event Notifications to invoke an AWS Lambda function when an image is uploaded. Use the function to resize the image

Create an Amazon EventBridge (Amazon CloudWatch Events) rule that invokes an AWS Lambda function on a schedule to resize uploaded images.

59. A company receives data from millions of users totalling about 1 TB each day. The company providers its users with usage report going back 12 months. All usage data must be stored for at least 5 years to comply with regularly and auditing requirement?

Which storage solution is MOST cost-effective?

Store the data in Amazon S3 Standard Set a lifecycle Set a lifecycle rule to transmission the data S3 Glacier Deep after 1 year. Set a lifecycle rule to data the data after 5 years.

Store the data in Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) Set a lifecycle rule to transition the data to S3 Glacier after 1 year set the lifecycle rule to delete the data after 5 years.

Store the data in Amazon Standard Set a lifecycle rule to transmission the data to S3 Standard-infrequence Access (S3 Standard-IA) after 1 year Set a lifecycle rule to delete the data after 5 years.

Store the data in Amazon S3 Standard Set a lifecycle rule to transition the data to S3 Zone-Infrequent Access (S3 One Zones-IA) after 1 year. Set a lifecycle rule to delete the data after 5 years.

60. A company hosts more than 300 global websites and applications. The company requires a platform to analyze more than 30 TB of clickstream data each day.

What should a solutions architect do to transmit and process the clickstream data?

Design an AWS Data Pipeline to archive the data to an Amazon S3 bucket and run an Amazon EMR duster with the data to generate analytics

Create an Auto Scaling group of Amazon EC2 instances to process the data and send it to an Amazon S3 data lake for Amazon Redshift to use tor analysis

Cache the data to Amazon CloudFron: Store the data in an Amazon S3 bucket When an object is added to the S3 bucket, run an AWS Lambda function to process the data tor analysis.

Collect the data from Amazon Kinesis Data Streams. Use Amazon Kinesis Data Firehose to transmit the data to an Amazon S3 data lake Load the data in Amazon Redshift for analysis

Page 4 of 7

61. A company is running a web application on Amazon EC2 instances in an Auto Scaling group. The application uses a database that runs on an Amazon RDS for PostgreSQL DB instance. The application performs slowly as traffic increases, and the database experiences a heavy read load during periods of high traffic.

Which actions should a solutions architect take to resolve these performance issues? (Select TWO.)

Enable auto scaling for the DB instance.

Create a read replica for the DB instance. Configure the application to send read traffic to the read replica.

Enable Multi-AZ for the DB instance. Configure the application to send read traffic to the standby DB instance.

Create an Amazon ElastiCache cluster. Configure the application to cache query results in the ElastiCache cluster.

Configure the Auto Scaling group subnets to ensure that the EC2 instances are provisioned in the same Availability Zone as the DB instance.

62. CORRECT TEXT

A company provides machine learning solutions. The company's users need to download large dalasets from the company's Amazon S3 bucket. These downloads often take a long lime, especially when the users are running many simulations on a subset of those datasets. Users download the datasets to Amazon EC2 instances in the same AWS Region as the S3 bucket. Multiple users typically use the same datasets at the same time.

Which solution will reduce the lime that is required to access the datasets?

Configure the S3 bucket lo use the S3 Standard storage class with S3 Transfer Acceleration activated.

Configure the S3 bucket to use the S3 Intelligent-Tiering storage class with S3 Transfer Acceleration activated.

Create an Amazon Elastic File System (Amazon EFS) network Tile system. Migrate the datasets by using AWS DataSync.

Move the datasets onto a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume. Attach the volume to all the EC2 instances.

63. A company has a custom application running on an Amazon EC2 instance that

• Reads a large amount of data from Amazon S3

• Performs a multi-stage analysis.

Writes the results to Amazon DynamoDB

The application writes a significant number of large, temporary files during the multi-stage analysis. The process performance depends on the temporary storage performance.

What would be the fastest storage option for holding the temporary files?

Multiple Amazon S3 buckets with Transfer Acceleration for storage

Multiple Amazon EBS drives with Provisioned IOPS and EBS optimization

Multiple Amazon EFS volumes using the Network File System version 4 1 (NFSv4 1) protocol

Multiple instance store volumes with software RAID 0.

64. A solutions architect is designing the cloud architecture for a new application being deployed on AWS. The process should run in parallel while adding and removing application nodes as needed based on the number of fobs to be processed. The processor application is stateless. The solutions architect must ensure that the application is loosely copied and the job items are durably stored

Which design should the solutions architect use?

Create an Amazon SNS topic to send the jobs that need to be processed Create an Amazon Machine Image (AMI) that consists of the processor application Create a launch configuration that uses the AMI Create an Auto Scaling group using the launch configuration Set the scaling policy for the Auto Scaling group to add and remove nodes based on CPU usage

Create an Amazon SQS queue to hold the jobs that need to be processed Create an Amazon Machine image (AMI) that consists of the processor application Create a launch configuration that uses the AM' Create an Auto Scaling group using the launch configuration Set the scaling policy for the Auto Scaling group to add and remove nodes based on network usage

Create an Amazon SQS queue to hold the jobs that needs to be processed Create an Amazon Machine image (AMI) that consists of the processor application Create a launch template that uses the AMI Create an Auto Scaling group using the launch template Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of items in the SQS queue

Create an Amazon SNS topic to send the jobs that need to be processed Create an Amazon Machine Image (AMI) that consists of the processor application Create a launch template that uses the AMI Create an Auto Scaling group using the launch template Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of messages published to the SNS topic

65. A company recently implemented hybrid cloud connectivity using AWS Direct Connect and is migrating data to Amazon S3. The company is looking for a fully managed solution that will automate and accelerate the replication of data between the on-premises storage systems and AWS storage services.

Which solution should a solutions architect recommend to keep the data private?

Deploy an AWS DataSync agent for the on-premises environment Configure a sync job to replicate the data and connect it with an AWS service endpoint

Deploy an AWS DataSync agent for the on-premises environment. Schedule a batch job to replicate point-in-time snapshots to AW

Deploy an AWS Storage Gateway volume gateway for the on-premises environment. Configure it to store data locally, and asynchronously back up point-in-time snapshots to AW

Deploy an AWS Storage Gateway file gateway for the on-premises environment Configure it to store data locally, and asynchronously back up point-m-time snapshots to AW

66. A company is rebelling its data canter and wants to securely transfer 50 TB of data lo AWS *ilhm 2 weeks. The existing data center has a Site-to-Site VPN connection to AWS that is 90 % utilized

Which AWS service should a solutions architect use to meet these requirements?

AWS DataSync with a VPC endpoint

AWS Direct Conned

AWS Snowball Edge Storage Optimized

AWS Storage Gateway

67. A company has an application that uses Amazon Elastic File System (Amazon EFS) to store data. The files are 1 GB in size or larger and are accessed often only for the first few days after creation. The application data is shared across a cluster of Linux servers. The company wants to reduce storage costs for the application.

What should a solutions architect do to meet these requirements?

Implement Amazon FSx and mount the network drive on each server

Move the files from Amazon EFS and store them locally on each Amazon EC2 instance

Configure a lifecycle policy to move the files to the EFS Infrequent Access (IA) storage class after 7 days.

Move the files to Amazon S3 with S3 Lifecycle policies enabled. Rewrite the application to support mounting the S3 bucket

68. A company hosts its multi-tier, public web application in the AWS Cloud. The web application runs on Amazon EC2 instances and its database runs on Amazon RDS. The company is anticipating a large increase in sales during an upcoming holiday weekend A solutions architect needs to build a solution to analyze the performance of the web application with a granularity of no more than 2 minutes.

What should the solutions architect do to meet this requirement?

Send Amazon CloudWatch logs to Amazon Redshift Use Amazon QuickSight to perform further analysis

Enable detailed monitoring on all EC2 instances. Use Amazon CloudWatch metrics to perform further analysis.

Create an AWS Lambda function to fetch EC2 logs from Amazon CloudWatch Logs. Use Amazon CloudWatch metrics to perform further analysis

Send EC2 logs to Amazon S3. Use Amazon Redshift to fetch logs from the S3 bucket to process raw data for further analysis with Amazon QuickSight

69. A company wants to run an in-memory database for a latency-sensitive application that runs on Amazon EC2 instances. The application processes more than 100,000 transactions each minute and requires high network throughput. A solutions architect needs to provide a cost-effective network design that minimizes data transfer charges.

Which solution meets these requirements?

Launch all EC2 instances in the same Availability Zone within the same AWS Region. Specify a placement group with cluster strategy when launching EC2 instances.

Launch all EC2 instances in different Availability Zones within the same AWS Region. Specify a placement group with partition strategy when launching EC2 instances.

Deploy an Auto Scaling group to launch EC2 instances in different Availability Zones based on a network utilization target.

Deploy an Auto Scaling group with a step scaling policy to launch EC2 instances in different Availability Zones.

70. A company wants to use an AWS Region as a disaster recovery location for its on-premises infrastructure. The company has 10 TB of existing data and the on-premises data center has a 1Gbps internet connection A solution architect must find a solution so the company can have its existing data on AWS in 72 hours without transmitting it using an unencrypted channel.

Which solution should the solutions architect select

Send the initial 10 TB of data to AWS using FT

Send the initial 10 TB of data lo AWS using AWS Snowball.

Establish a VPN connection between Amazon VPC and the company's data center

Establish an AWS Direct Connect connection between Amazon VPC and the company's data canter

71. A company has a website hosted on AWS. The website is behind an Application Load Balancer (ALB) that is configured to handle HTTP and HTTPS separately. The company wants to forward all requests to the website so that the requests will use HTTPS.

What should a solutions architect do to meet this requirement?

Update the ALB's network ACL to accept only HTTPS traffic

Create a rule that replaces the HTTP in the URL with HTTP

Create a listener rule on the ALB to redirect HTTP traffic to HTTP

Replace the ALB with a Network Load Balancer configured to use Server Name Indication (SNI).

72. A security learn needs to enforce the rotation of all 1AM users' access keys every 90 days If an access key Is found to be older, the key must be made inactive and removed A solutions architect must create a solution that will check for and remediate any keys older than 90 days

Which solution meets these requirements with the LEAST operational effort?

Create an AWS Config rule to check for the key age Configure the AWS Config rule to run an AWS Batch job to remove the key

Create an Amazon EventBridge (Amazon CloudWatch Events) rule to check for the key age Configure the rule to run an AWS Batch job to remove the key

Create an AWS Config rule to check for the key age Define an Amazon EventBridge (Amazon CloudWatch Events) rule to schedule an AWS Lambda function to remove the key

Create an Amazon EventBridge (Amazon CloudWatch Events) rule to check for the key age Define an EventBridge (CloudWatch Events) rule to run an AWS Batch job to remove the key

73. A company wants to provide users with access lo AWS resources. The company has 1.500 users and manages their access to on-premises resources through Active Directory user groups on the corporate network However, the company does not want users to have to maintain another identity to access the resources A solutions architect must manage user access to the AWS resources while preserving access to the on-premises resources

What should the solutions architect do to meet these requirements?

Create an IAM user for each user in the company Attach the appropriate policies to each user

Use Amazon Cognito with an Active Directory user pool Create rotes with the appropriate policies attached

Define cross-account roles with the appropriate policies attached Map the roles to the Active Directory groups

Configure Security Assertion Markup Language (SAML) 2 0-based federation Create roles with the appropriate policies attached Map the roles to the Active Directory groups

74. A company stores project information in a shared spreadsheet. The company wants to create a web application to replace the spreadsheet. The company has chosen Amazon DynamoDB to store the spreadsheet's data and is designing the web application to display the project information that is obtained from DynamoDB.

A solutions architect must design the web application's backend by using managed services that require minimal operational maintenance.

Which architectures meet these requirements? (Select TWO.)

An Amazon API Gateway REST API accesses the project information that is in DynamoD

An Elastic Load Balancer forwards requests to a target group with DynamoDB set up as the target.

An Amazon API Gateway REST API invokes an AWS Lambda function. The Lambda function accesses DynamoD

An Amazon Route 53 hosted zone routes requests to an AWS Lambda endpoint to invoke a Lambda function that accesses DynamoD

An Elastic Load Balancer forwards requests to a target group of Amazon EC2 instances. The EC2 instances run an application that accesses DynamoD

75. A company needs to connect its on-premises data center network to a new VPC. The data center network has a 100 Mbps symmetrical internet connection. An application that is running on premises will transfer multiple gigabytes of data each day. The application will use an Amazon Kinesis Data Firehose delivery stream for processing

What should a solutions architect recommend for maximum performance?

Create a VPC peering connection between the on-premises network and the VPC Configure routing for the on-premises network to use the VPC peering connection.

Procure an AWS Snowball Edge Storage Optimized device. After several days' worth of data has accumulated, copy the data to the device and ship the device to AWS for expedited transfer to Kinesis Data Firehose Repeat as needed

Create an AWS Site-to-Site VPN connection between the on-premises network and the VPC Configure BGP routing between the customer gateway and the virtual private gateway. Use the VPN connection to send the data from on premises to Kinesis Data Firehose.

Use AWS PrivateLink to create an interface VPC endpoint for Kinesis Data Firehose in the VP

Set up a 1 Gbps AWS Direct Connect connection between the on-premises network and AWS Use the PrivateLink endpoint to send the data from on premises to Kinesis Data Firehose.

76. A healthcare computer stores highly sensitive records. Compliance requires that multiple copies be stored in different locations. Each record must be stored for 7 years. The company has a service level agreement (SLA) to provide records to government agencies immediately for the first 30 days and thin within 4 hours of a request thereafter.

What should a solutions architect recommend?

Use Amazon S3 with cross-Region Region replication enabled. After 30 days. Transition the data to Amazon S3 Glacier using lifecycle policy.

Use Amazon S3 with cross-origin resource sharing (CCRS) enabled. After 30 days. Transition on the data to Amazon S3 Glacier using a lifecycle policy.

Use Amazon S3 with cross-origin replication enabled. After 30 days, transition the data to Amazon S3 Glacier Deep Archive a lifecycle policy.

Use Amazon S3 with cross-origin resource sharing (CCRS) enabled. After 30 days, transition on the data to Amazon S3 Glacier Deep Archive using a lifecycle policy.

77. A weather forecasting company needs to process hundreds of gigabytes of data with sub-mill (second latency. The company has a high performance computing (HPC) environment in its data center and wants to expand its forecasting capabilities

A solutions architect must identify a highly available cloud storage solution that can handle large amounts of sustained throughput Files that are stored in the solution should be accessible to thousands of compute instances that will simultaneously access and process the entire dataset

What should the solutions architect do to meet these requirements?

Use Amazon FSx for Lustre scratch file systems.

Use Amazon FSx for Lustre persistent file systems

Use Amazon Elastic File System (Amazon EFS) with Bursting Throughput mode

Use Amazon Elastic File System (Amazon EFS) with Provisioned Throughput mode

78. A company plans to store sensitive user data on Amazon S3 internal security compliance requirement mandate encryption of data before secured it to Amazon S3.

What should a solutions architect recommend to safely these requirements?

Server-side encryption with customer-provided encryption keys.

Client-side encryption with Amazon S3 managed encryption keys.

Service-side encryption with keys stored in AWS Management Service (AWS KMS)

Server-side encryption with a master stored in AWS Management Service (AWS KMS)

79. A company wants lo share data that is collected from sell-driving cars with the automobile community. The data will be made available (rom within an Amazon S3 bucket. The company wants to minimize its cost of making this data available to other AWS accounts.

What should a solutions architect do to accomplish this goal?

Create an S3 VPC endpoint for the bucket.

Configure the S3 bucket to be a Requester Pays bucket.

Create an Amazon CloudFront distribution in front of the S3 bucket.

Require that the fries be accessible only with the use of the BitTorrent protocol.

80. A company's packaged application dynamically creates and returns single-use text files in response to user requests. The company is using Amazon CloudFront for distribution^ but wants to further reduce data transfer costs. The company cannot modify the application's source code

What should a solutions architect do to reduce costs?

Use Lambda@Edge to compress the files as they are sent to users.

Enable Amazon S3 Transfer Acceleration to reduce the response times

Enable caching on the CloudFront distribution to store generated files at the edge.

Use Amazon S3 multipart uploads to move the files to Amazon S3 before returning them to users

Page 5 of 7

81. A company is deploying a two-tier web application in a VPC. The web tier is using an Amazon EC2 Auto Scaling group with public subnets that span multiple Availability Zones. The database tier consists of an Amazon RDS for MySQL DB instance in separate private

subnets. The web tier requires access to the database to retrieve product information.

The web application is not working as intended. The web application reports that it cannot connect to the database. The database is confirmed to be up and running. All configurations for the network ACLs. security groups, and route tables are still in their default states.

What should a solutions architect recommend to fix the application?

Add an explicit rule to the private subnet's network ACL to allow traffic from the web tier's EC2 instances.

Add a route in the VPC route table to allow traffic between the web tier's EC2 instances and Ihe database tier.

Deploy the web tier's EC2 instances and the database tier's RDS instance into two separate VPCs. and configure VPC peering.

Add an inbound rule to the security group of the database tier's RDS instance to allow traffic from the web tier's security group.

82. A solutions architect must design a solution that uses Amazon CloudFront with an Amazon S3 origin to store a static website. The company's security policy requires that all website traffic be inspected by AWS WAF.

How should the solutions architect comply with these requirements?

Configure an S3 bucket policy to accept requests coming from the AWS WAF Amazon Resource Name (ARN) only.

Configure Amazon CloudFront to forward all incoming requests to AWS WAF before requesting content from the S3 origin.

Configure a security group that allows Amazon CloudFront IP addresses to access Amazon S3 only. Associate AWS WAF to CloudFront.

Configure Amazon CloudFront and Amazon S3 to use an origin access identity (OAI) to restrict access to the S3 bucket Enable AWS WAF on the distribution

83. A social media company is building a feature tor its website. The feature will give users the ability to upload photos. The company expects significant increases in demand during large events and must ensure that the website can handle the upload traffic from users.

Which solution meets these requirements with the MOST scalability?

Upload files from the user's browser to the application servers Transfer the files to an Amazon S3 bucket.

Provision an AWS Storage Gateway file gateway. Upload files directly from the user's browser to the file gateway.

Generate Amazon S3 presigned URLs in the application. Upload files directly from the user's browser into an S3 bucket

Provision an Amazon Elastic File System (Amazon EFS) file system. Upload files directly from the user's browser to the file system.

84. A company maintains about 300 TB in Amazon S3 Standard storage month after month. The S3 objects are each typically around 50 GB in size and are frequently replaced with multipart uploads by their global application. The number and size of S3 objects remain constant but the company's S3 storage costs are increasing each month

How should a solutions architect reduce costs in this situation?

Switch from multipart uploads to Amazon S3 Transfer Acceleration

Enable an S3 Lifecycle policy that deletes incomplete multipart uploads

Configure S3 inventory to prevent objects from being archived too quickly

Configure Amazon CloudFront to reduce the number of objects stored in Amazon S3

85. A company is developing a mobile game that streams score updates to a backend processor and then posts results on a leaderboard A solutions architect needs to design a solution that can handle large traffic spikes process the mobile game updates in order of receipt and store the processed updates in a highly available database. The company also wants to minimize the management overhead required to maintain the solution

What should the solutions architect do to meet these requirements?

Push score updates to Amazon Kinesis Data Streams Process the updates in Kinesis Data Streams with AWS Lambda Store the processed updates in Amazon DynamoDB

Push score updates to Amazon Kinesis Data Streams Process the updates with a fleet of Amazon EC2 instances set up for Auto Scaling Store the processed updates in Amazon Redshifi

Push score updates to an Amazon Simple Notification Service (Amazon SNS) topic Subscribe an AWS Lambda function to the SNS topic to process the updates Store the processed updates in a SQL database running on Amazon EC2

Push score updates to an Amazon Simple Queue Service (Amazon SQS) queue Use a fleet of Amazon EC2 instances with Auto Scaling to process the updates in the SQS queue Store the processed updates in an Amazon RDS Multi-AZ DB instance

86. A company is launching a new application deployed on an Amazon Elastic Container Service (Amazon ECS) cluster and is using the Fargate launch type tor ECS tasks. The company is monitoring CPU and memory usage because it is expecting high traffic to the application upon its launch However the company wants to reduce costs when utilization decreases

What should a solutions architect recommend?

Use Amazon EC2 Auto Scaling to scale at certain periods based on previous traffic patterns

Use an AWS Lambda function to scale Amazon ECS based on metric breaches that trigger an Amazon CloudWatch alarm

Use Amazon EC2 Auto Scaling with simple scaling policies to scale when ECS metric breaches trigger an Amazon CloudWatch alarm

Use AWS Application Auto Scaling with target tracking policies to scale when ECS metric breaches trigger an Amazon CloudWatch alarm

87. A company receives inconsistent service from its data center provider because the company is headquartered in an area affected by natural disasters. The company is not ready to fully migrate to the AWS Cloud but it wants a failure environment on AWS in case the on-premises data center fails

The company runs web servers that connect to external vendors. The data available on AWS and on premises must be uniform.

Which solution should a solutions architect recommend that has the LEAST amount of downtime''

Configure an Amazon Route 53 failover record Run application servers on Amazon EC2 instances behind an Application Load Balancer in an Auto Scaling group Set up AWS Storage Gateway with stored volumes to back up data to Amazon S3.

Configure an Amazon Route 53 failover record Execute an AWS CloudFormation template from a script to create Amazon EC2 instances behind an Application Load Balancer Set up AWS Storage Gateway with stored volumes to back up data to Amazon S3

Configure an Amazon Route 53 failover record Set up an AWS Direct Connect connection between a VPC and the data center Run application servers on Amazon EC2 in an Auto Scaling group Run an AWS Lambda function to execute an AWS CloudFormation template to create an Application Load Balancer

Configure an Amazon Route 53 failover record Run an AWS Lambda function to execute an AWS CloudFormation template to launch two Amazon EC2 instances Set up AWS Storage Gateway with stored volumes to back up data to Amazon S3 Set up an AWS Direct Connect connection between a VPC and the data center

88. A computer is reviewing a recent migration of a three-tier application to a VPC. The security team discover that the principle of lest privilege is not being applied to Amazon EC2 security group ingress and egress rules between the application tiers.

What should a solution architect do to connect issue?

Create security group rules using the instance ID as the source destination.

Create security group rules using the security ID as the source or destination.

Create security group rules using the VPC CDR blocks as the source or destination

Create security group rules using the subnet CDR blocks as the source or destination

89. An administrator of a large company wants to monitor for and prevent any cryptocurrency-related attacks on the company's AWS accounts.

Which AWS service can the administrator use to protect the company against attacks?

Amazon Cognito

Amazon Guard Duty

Amazon Inspector

Amazon Macie

90. A company collects 10 GB of telemetry data dairy from various machines. The company stores the data in an Amazon S3 bucket in a source data account.

The company has hired several consuming agencies to use this data for analysis. Each agency needs read access to the data for its analysis. The company must share the data from tie source data account by choosing a solution that maximizes security and operational efficiency.

Which solution will meet these requirements?

Configure S3 global tables to replicate data tor each agency

Make the S3 bucket public for a limited time Inform only the agencies

Configure cross-account access for the S3 bucket to the accounts that the agencies own.

Set up an IAM user for each analyst In the source data account Grant each user access to the S3 bucket

91. A company serves content to its subscribers across the world using an application running on AWS. The application has several Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB) Due to a recent change in copyright restrictions, the chief information officer (CiO) wants to block access for certain countries.

Which action will meet these requirements?

Modify the ALB security group to deny incoming traffic from blocked countries

Modify the security group for EC2 instances to deny incoming traffic from blocked countries

Use Amazon CloudFront to serve the application and deny access to blocked countries

Use ALB listener rules to return access dented responses to incoming traffic from blocked countries

92. A company is building a new furniture inventory application. The company has deployed the application on a fleet of Amazon EC2 instances across multiple Availability Zones. The EC2 instances run behind an Application Load Balancer (ALB) in their VPC

A solutions architect has observed that incoming traffic seems to favor one EC2 instance resulting in latency for some requests

What should the solutions architect do to resolve this issue?

Disable session affinity (sticky sessions) on the ALB

Replace the ALB with a Network Load Balancer

increase the number of EC2 instances in each Availability Zone

Adjust the frequency of the health checks on the ALB's target group

93. An ecommerce company is creating an application that requires a connection to a third-party payment service to process payments. The payment service needs to explicitly allow the public IP address of the server that is making the payment request. However, the company's security policies do not allow any server to be exposed directly to the public internet.

Which solution will meet these requirements?

Provision an Elastic IP address. Host the application servers on Amazon EC2 instances in a private subnet. Assign the public IP address to the application servers.

Create a NAT gateway in a public subnet. Host the application servers on Amazon EC2 instances in a private subnet Route payment requests through the NAT gateway.

Deploy an Application Load Balancer (ALB). Host the application servers on Amazon EC2 instances in a private subnet. Route the payment requests through the AL

Set up an AWS Client VPN connection to the payment service Host the application servers on Amazon EC2 instances in a private subnet Route the payment requests through the VP

94. A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company s chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use ol physical backup tapes. The company must preserve the existing investment in the on-premises backup applications and workflows

What should a solutions architect recommend''

Set up AWS Storage Gateway to conned with the backup applications using the NFS interface

Set up an Amazon EFS file system that connects wtth the backup applications using the NFS interface

Set up an Amazon EFS file system that connects with the backup applications using the iSCSl interface

Set up AWS Storage Gateway to connect with the backup applications using the iSCSi-virtual tape library (VTL) interface

95. A company wants lo build an immutable infrastructure for its software applications. The company wants to test the software applications before sending traffic to them. The company seeks an efficient solution that limits the effects of application bugs

Which combination of steps should a solutions architect recommend? {Select TWO)

Use AWS Cloud Formation to update the production infrastructure and roll back the stack if the update fails

Apply Amazon Route 53 weighted routing to test the staging environment and gradually increase the traffic as the tests pass

Apply Amazon Route 53 failover routing to test the staging environment and fail over to the production environment if the tests pass

Use AWS Cloud Formation with a parameter set to the staging value in a separate environment other than the production environment

Use AWS Cloud Formation to deploy the staging environment with a snapshot deletion policy and reuse the resources in the production environment if the tests pass

96. A company currently has 250 TB of backup files stored in Amazon S3 in a vendor's proprietary format. Using a Linux-based software application provided by the vendor, the company wants to retrieve files from Amazon S3, transform the files to an industry-standard format, and re-upload them to Amazon S3. The company wants to minimize the data transfer charges associated with this conversion

What should a solutions architect do to accomplish this?

Install the conversion software as an Amazon S3 batch operation so the data is transformed without leaving Amazon S3

Install the conversion software onto an on-premises virtual machine. Perform the transformation and re-upload the files to Amazon S3 from the virtual machine.

Use AWS Snowball Edge devices to export the data and install the conversion software onto the devices. Perform the data transformation and re-upload the files to Amazon S3 from the Snowball Edge devices

Launch an Amazon EC2 instance in the same Region as Amazon S3 and install the conversion software onto the instance. Perform the transformation and re-upload the files to Amazon S3 from the EC2 instance.

97. A company is running a mission-critical application on Amazon EC2 instances henna an Application Load Balancer. The instances run in an Auto Scaling group in a single AWS Region. The application is using a database in Ama2on Aurora as the data tier. A recent audit revealed that the current deployment of Aurora is not highly available.

What should a solutions architect do to improve the availability of the database

Configure an Aurora Replica

Configure storage replication.

Configure storage auto scaling.

Configure cross-Region replication

98. A company is managing health records on-peruses. The company must keep these records Indefinitely, disable any modifications to the records once they are stored, and granularly audit access at all levels. The chief technology officer (CTO) is concerned because there are already millions of record not being used by any application, and the current infrastructure is running out of space. The CTO has requested solutions architect design a solution to move easting data and support future records.

Which services can the solutions architect recommend to meet these requirements?

Use AWS DataSync to move existing data to AWS Use Amazon S3 to store existing and new data Enable Amazon S3 object lock and enable AWS CloudTrail with data events

Use AWS Storage Gateway to move existing data to AWS Use Amazon S3 to store existing and new data Enable Amazon S3 object lock and enable AWS CloudTrail with management events

Use AWS DataSync to move exiting data to AWS Use Amazon S3 to store existing and new data. Enable Amazon S3 object lock and enable AWS CloudTrail with management events.

Use AWS Storage Gateway to move existing data to AWS Use Amazon Elastic Block Stores (Amazon EBS) to store existing and new data. Enable Amazon S3 object lock and enable Amazon S3 server access logging

99. A company is hosting 60 TB of production-level data in an Amazon S3 bucket A solutions architect needs to bring that data on premises for quarterly audit requirements This export of data must be encrypted while in transit. The company has low network bandwidth in place between AWS and its on-premises data center.

What should the solutions architect do to meet these requirements?

Deploy AWS Migration Hub with 90-day replication windows for data transfer

Deploy an AWS Storage Gateway volume gateway on AWS Enable a 90-day replication window to transfer the data

Deploy Amazon Elastic File System (Amazon EFS). with Iifecycle policies enabled, on AWS Use it to transfer the data

Deploy an AWS Snowball device in the on-premises data center after completing an export Job request In the AWS Snowball console

100. A company has deployed a business-critical application in the AWS Good. The application uses Amazon EC2 instances that run in the us-east-1 Region. The application uses Amazon S3 for storage of all critical data

To meet compliance requirements the company must create a disaster recovery (DR) plan that provides the capability of a full failover to another AWS Region

What should a solutions architect recommend for this DR plan?

Deploy the application to multiple Availability Zones in us-east-1 Create a resource group in AWS Resource Groups Turn on automatic failover for the application to use a predefined recovery Region

Perform a virtual machine (VM) export by using AWS Import/Export on the existing EC2 instances Copy the exported instances to the destination Region in the event of a disaster provision new EC2 instances from the exported EC2 instances

Create snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instances in us-east-t Copy the snapshots to the destination Region In the event of a disaster provision new EC2 instances from the EBS snapshots

Use S3 Cross-Region Replication for the data that is stored in Amazon S3 Create an AWS CloudFormation template for the application with an S3 bucket parameter In the event of a disaster deploy the template to the destination Region and specify the local S3 bucket as the parameter

Page 6 of 7

101. A solutions architect must transfer 750 TB of data from an on-premises network-attached file system to Amazon S3 Glacier. The migration must not saturate the on-premises 10 Mbps internet connection.

Which solution will meet these requirements?

Create an AWS Site-to-Site VPN tunnel to an S3 bucket Transfer the files directly by using the AWS CL

Order 10 AWS Snowball Edge Storage Optimized devices, and select an S3 Glacier vault as the destination.

Mount the network-attached file system to an S3 bucket, and copy the files directly. Create an S3 Lifecycle policy to transition the S3 objects to S3 Glacier.

Order 10 AWS Snowball Edge Storage Optimized devices, and select an S3 bucket as the destination. Create an S3 Lifecycle policy to transition the S3 objects to S3 Glacier.

102. A company hosts historical weather records in Amazon S3. The records are downloaded from the company's website by way of a URL that resolves to a domain name Users all over the world access this content through subscriptions. A third-party provider hosts the company's root domain name, but the company recently migrated some of its services to Amazon Route 53. The company wants to consolidate contracts, reduce latency for users, and reduce costs related to serving the application to subscribers.

Which solution meets these requirements?

Create a web distribution on Amazon CloudFront to serve the S3 content for the application Create a CNAME record in a Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name.

Create a web distribution on Amazon CloudFront to serve the S3 content for the application Create an ALIAS record in the Amazon Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name.

Create an A record in a Route 53 hosted zone for the application. Create a Route 53 traffic policy for the web application, and configure a geolocation rule. Configure health checks to check the health of the endpoint and route DNS queries to other endpoints if an endpoint is unhealthy.

Create an A record in a Route 53 hosted zone for the application. Create a Route 53 traffic policy for the web application, and configure a geoproximity rule. Configure health checks to check the health of the endpoint and route DNS queries to other endpoints if an endpoint is unhealthy

103. A solutions architect is creating a new VPC design There are two public subnets for the load balancer, two private subnets for web servers and two private subnets for MySQL. The web servers use only HTTPS. The solutions architect has already created a security group tor the load balancer allowing port 443 from 0 0 0 0/0 Company policy requires that each resource has the teas! access required to still be able to perform its tasks

Which additional configuration strategy should the solutions architect use to meet these requirements?

Create a security group for the web servers and allow port 443 from 0 00 0/0 Create a security group for the MySQL servers and allow port 3306 from the web servers security group

Create a network ACL for the web servers and allow port 443 from 0 0 0 0*0 Create a network ACL (or the MySQL servers and allow port 3306 from the web servers security group

Create a security group for the web servers and allow port 443 from the load balancer Create a security group for the MySQL servers and allow port 3306 from the web servers security group

Create a network ACL 'or the web servers and allow port 443 from the load balancer Create a network ACL for the MySQL servers and allow port 3306 from the web servers security group

104. A company has an AWS Lambda function that needs read access to an Amazon S3 bucket that is located in the same AWS account.

Which solution will meet these requirement in the MOST secure manner?

Apply an S3 bucket pokey that grants road access to the S3 bucket

Apply an IAM role to the Lambda function Apply an 1AM policy to the role to grant read access to the S3 bucket

Embed an access key and a secret key In the Lambda function's coda to grant the required 1AM permissions for read access to the S3 bucket

Apply an IAM role to the Lambda function. Apply an IAM policy to the role to grant read access to all S3 buckets In the account

105. A business application is hosted on Amazon EC2 and uses Amazon S3 for encrypted object storage. The chief information security officer has directed that no application traffic between the two services should traverse the public internet.

Which capability should the solutions architect use to meet the compliance requirements?

AW3 Key Management Service (AWS KMS)

VPC endpoint

Private subnet

Virtual private gateway

106. An application runs on Amazon EC2 instances in private subnets. The application needs to access an Amazon DynamoDB table.

What is me MOST secure way to access the table while ensuring that the traffic does not leave the AWS network?

Use a VPC endpoint for DynamoDB

Use a NAT gateway in a public subnet

Use a NAT instance in a private subnet

Use the internet gateway attached to the VPC

107. A solution architect has created a new AWS account and must secure AWS account root user access.

Which combination of actions mil accomplish this? (Select TWO)

Ensure the root user uses a strong password

Enable multi-factor authentication to the root user

Store root user access keys m an encrypted Amazon S3 bucket

Add the root user to a group containing administrative permissions

Apply the required permissions to the root user with an inline policy document

108. A company has an application that uses an Amazon OynamoDB table lew storage. A solutions architect discovers that many requests to the table are not returning the latest data. The company's users have not reported any other issues with database performance Latency is in an acceptable range.

Which design change should the solutions architect recommend?

Add read replicas to the table. B Use a global secondary index (GSI).

Request strongly consistent reads for the table

Request eventually consistent reads for the table.

109. A user wants to list the 1AM role that Is attached to their Amazon EC2 Instance. The user has login access to the EC2 instance but does not have 1AM permissions.

What should a solutions architect do to retrieve this information?

A)

Option A

Option B

Option C

Option D

110. A company recently signed a contract with an AWS Managed Service Provider (MSP) Partner for help with an application migration initiative. A solutions architect needs to share an Amazon Machine Image (AMI) from an existing AWS account with the MSP Partner's AWS account. The AMI is backed by Amazon Elastic Block Store (Amazon EBS) and uses a customer managed customer master key (CMK) to encrypt EBS volume snapshots.

What is the MOST secure way for the solutions architect to share the AMI with the MSP Partner's AWS account?

Make the encrypted AMI and snapshots publicly available. Modify the CMK's key policy to allow the MSP Partner's AWS account to use the key

Modify the launchPermission property of the AM

Share the AMI with the MSP Partner's AWS account only. Modify the CMK's key policy to allow the MSP Partner's AWS account to use the key.

Modify the launchPermission property of the AMI Share the AMI with the MSP Partner's AWS account only. Modify the CMK's key policy to trust a new CMK that is owned by the MSP Partner for encryption.

Export the AMI from the source account to an Amazon S3 bucket in the MSP Partner's AWS account. Encrypt the S3 bucket with a CMK that is owned by the MSP Partner Copy and launch the AMI in the MSP Partner's AWS account.

111. A company has two VPCs that are located in the us-west-2 Region within the same AWS account. The company needs to allow network traffic between these VPCs. Approximately 500 GB of data transfer will occur between the VPCs each month.

What is the MOST cost-effective solution to connect these VPCs?

Implement AWS Transit Gateway to connect the VPCs Update the route tables of each VPC to use the transit gateway for inter-VPC communication

Implement an AWS Site-to-Stte VPN tunnel between the VPCs. Update the route tables of each VPC to use the VPN tunnel for inter-VPC communication

Set up a VPC peering connection between the VPCs. Update the route tables of each VPC to use the VPC peering connection for inter-VPC communication.

Set up a 1 GB AWS Direct Connect connection between the VPCs. Update the route tables of each VPC to use the Direct Connect connection for inter-VPC communication.

112. A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier in the public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets. The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third-party provider A solutions architect must devise a strategy that maximizes security without increasing operational overhead

What should the solutions architect do to meet these requirements?

Deploy a NAT instance in the VPC Route all the internet-based traffic through the NAT instance

Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway.

Configure an internet gateway and attach it to the VPC Modify the private subnet route table to direct internet-bound traffic to the internet gateway

Configure a virtual private gateway and attach it to the VPC Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.

113. A development team needs to host a website that will be accessed by other teams. The website contents consist of HTML. CSS, client-side JavaScript, and images.

Which method is the MOST cost-effective for hosting the website?

Containerize the website and host it in AWS Fargate.

Create an Amazon S3 bucket and host the website there

Deploy a web server on an Amazon EC2 instance to host the website.

Configure an Application Loa d Balancer with an AWS Lambda target that uses the Express js framework.

114. A company is migrating a large, mission-critical database to AWS. A solutions architect has decided to use an Amazon RDS for MySQL Multi-AZ DB instance that Is deployed with 80,000 Provisioned IOPS for storage. The solutions architect is using AWS Database Migration Service (AWS DMS) to perform the data migration. The migration is taking longer than expected, and the company wants to speed up the process. The company's network team has ruled out bandwidth as a limiting factor.

Which actions should the solutions architect take to speed up the migration? (Select TWO.)

Disable Multi-AZ on the target DB instance.

Create a new DMS instance that has a larger instance size.

Turn off logging on the target DB instance until the initial load is complete.

Restart the DMS task on a new DMS instance with transfer acceleration enabled.

Change the storage type on the target DB instance to Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp2).

115. A website runs a web application that receives a burst of traffic each day at noon. The users upload new pictures and context daily, but have complaining of timeout. The architect uses Amazon EC2 Auto Scaling groups, and the custom application consistently takes 1 minutes to initiate upon boot up before responding to user requests.

How should a solutions architect redesign the architect to better respond to changing traffic?

Configure a Network Load Balancer with a slow start configuration.

Configure AWS ElastiCache for Redis to offload direct requests to the servers.

Configure an Auto Scaling step scaling policy with an instance warmup condition.

Configure Amazon CloudFront to use an Application Load Balancer as the origin.

116. A company is building a media sharing application and decides to use Amazon S3 for storage When a media file is uploaded, the company starts a multi-step process to create thumbnails identity objects in the images transcode videos into standard formats and resolutions and extract and store the metadata to an Amazon DynamoDB table. The metadata is used for searching and navigation

The amount of traffic is variable. The solution must be able to scale to handle spikes in load without unnecessary expenses

What should a solutions architect recommend to support this workload''

Build the processing into the website or mobile app used to upload the content to Amazon S3 Save the required data to the DynamoDB table when the objects are uploaded

Trigger AWS Step Functions when an object is stored in the S3 bucket Have the Step Functions perform the steps needed to process the object and then write the metadata to the DynamoDB table

Trigger an AWS Lambda function when an object is stored in the S3 bucket Have the Lambda function start AWS Batch to perform the steps to process the object Place the object data m the DynamoDB table when complete

Trigger an AWS Lambda function to store an initial entry in the DynamoDB table when an object is uploaded to Amazon S3 Use a program running on an Amazon EC2 instance in an Auto Scaling group to poll the index for unprocessed items, and use the program to perform the processing

117. A company has an ecommerce application that stores data in an on-premises SQL database. The company has decided to migrate this database to AWS. However, as part of the migration, the company wants to find a way to attain sub-millisecond responses to common read requests

A solutions architect knows that the increase in speed is paramount and that a small percentage of stale data returned in the database reads is acceptable.

What should the solutions architect recommend'?

Build Amazon RDS read replicas.

Build the database as a larger instance type.

Build a database cache using Amazon ElastiCache

Build a database cache using Amazon Elasticsearch Service (Amazon ES).

118. A company is developing an Internal application that uses a PostgreSQL database. The company has decided to host the database on Amazon Aurora. The application does not need to be highly available but data must be stored in multiple Availability Zones to maximize durability.

Which database configuration meets these requirements MOST cost-effectively?

An Aurora PostgreSQL DB cluster with a single D8 Instance

An Aurora PostgreSQL DB cluster with a primary DB instance and a read replica

An Aurora PostgreSQL DB cluster with Multi-AZ deployment enabled

An Aurora PostgreSQL global database cluster

119. A company has been running a web application with an Oracle relational database in an on-premises data center for the past 15 years. The company must migrate the database to AWS. The company needs to reduce operational overhead without having to modify the application's code.

Which solution meets these requirements?

Use AWS Database Migration Service (AWS DMS) to migrate the database servers to Amazon RD

servers.

Use AWS Database Migration Service (AWS DMS) to migrate the database servers to Amazon DynamoD

Use an AWS Snowball Edge Storage Optimized device to migrate the data from Oracle to Amazon Aurora.

120. A company has a website running on Amazon EC2 Instances across two Availability Zones. The company is expecting spikes in traffic on specific holidays and wants to provide a consistent user experience.

How can a solutions architect meet this requirement?

Use step scaling

Use simple scaling

Use lifecycle hooks

Use scheduled scaling

Page 7 of 7

121. A company has a three-tier environment on AWS that ingests sensor data from its users' devices. The traffic flows through a Network Load Balancer (NIB) then to Amazon EC2 instances for the web tier and finally to EC2 instances for the application tier that makes database calls

What should a solutions architect do to improve the security of data in transit to the web tier?

Configure a TLS listener and add the server certificate on the NLB

Configure AWS Shield Advanced and enable AWS WAF on the NLB

Change the load balancer to an Application Load Balancer and attach AWS WAF to it

Encrypt the Amazon Elastic Block Store (Amazon EBS) volume on the EC2 instances using AWS Key Management Service (AWS KMS)

122. A company has a Microsoft NET application that runs on an on-premises Windows Server. The application stores data by using an Oracle Database Standard Edition server. The company is planning a migration to AWS and wants to minimize development changes while moving the application. The AWS application environment should be highly available.

Which combination of actions should the company take to meet these requirements? (Select TWO.)

Refactor the application as serverless with AWS Lambda functions running NET Core.

Rehost the application in AWS Elastic Beanstalk with the .NET platform in a Multi-AZ deployment.

Replatform the application to run on Amazon EC2 with the Amazon Linus Amazon Machine Image (AMI).

Use AWS Database Migration Service (AWS DMS) to migrate from the Oracle database to Amazon DynamoDB in a Multi-AZ deployment.

Use AWS Database Migration Service (AWS DMS) to migrate from the Oracle database to Oracle on Amazon RDS in a Multi-AZ deployment.

123. A company is launching a new application that will be hosted on Amazon EC2 instances. A solutions architect needs to design a solution that does not allow public IPv4 access that originates from the internet. However, the solution must allow the EC2 instances to make outbound IPv4 internet requests.

The initial design proposal shows that the EC2 instances would be located in two private subnets across two Availability Zones. The entire architecture must be highly available.

How should the solutions architect change the architecture to meet these requirements?

Deploy a NAT gateway in public subnets in both Availability Zones. Create and configure one route table for each private subnet.

Deploy an internet gateway in public subnets in both Availability Zones. Create and configure a shared route table for the private subnets.

Deploy a NAT gateway in public subnets in both Availability Zones. Create and configure a shared route table for the private subnets.

Deploy an egress-only internet gateway in public subnets in both Availability Zones. Create and configure one route table for each private subnet.

124. A company uses an Amazon S3 bucket to store static images for its website. The company configured permissions to allow access to Amazon S3 objects by privileged users only.

What should a solutions architect do to protect against data loss? (Select TWO.)

Enable versioning on the S3 bucket

Enable access togging on the S3 bucket.

Enable server-side encryption on the S3 bucket.

Configure an S3 lifecycle rule to transition objects to Amazon S3 Glacier.

Use MFA Delete to require multi-factor authentication to delete an object.

125. A company that operates a web application on premises is preparing to launch a newer version of the application on AWS. The company needs to route requests to either the AWS-hosted or the on-premises-hosted application based on the URL query string. The on-premises application Is not available from the Internet, and a VPN connection Is established between Amazon VPC and the company's data center. The company wants to use an Application Load Balancer (ALB) for this launch

Which solution meets these requirements?

Use two ALBs: one for on premises and one for the AWS resource Add hosts to each target group of each ALB Route with Amazon Route 53 based on the URL query string

Use Mo ALBs; one for on premises and one for the AWS resource Add hosts to the target group of each ALB Create a software router on an EC2 instance based on the URL query string

Use one ALB with two target groups one for the AWS resource and one for on premises Add hosts to each target group of the ALB Configure listener rules based on the URL query string

Use one ALB with two AWS Auto Scaling groups one for the AWS resource and one for on premises Add hosts to each Auto Scaling group Route with Amazon Route 53 based on the URL query string

126. A company is hosting a three-tier ecommerce application in the AWS Cloud. The company hosts the website on Amazon S3 and integrates the website with an API that handles sales requests. The company hosts the API on three Amazon EC2 instances behind an Application Load Balancer (ALB). The API consists of static and dynamic front-end content along with backend workers that process sales requests asynchronously.

The company is expecting a significant and sudden increase in the number of sales requests during events for the launch of new products

What should a solutions architect recommend to ensure that all the requests are processed successfully?

Add an Amazon CloudFront distribution for the dynamic content. Increase the number of EC2 instances to handle the increase in traffic.

Add an Amazon CloudFront distribution for the static content. Place the EC2 instances in an Auto Scaling group to launch new instances based on network traffic.

Add an Amazon CloudFront distribution for the dynamic content. Add an Amazon ElastiCache instance in front of the ALB to reduce traffic for the API to handle.

Add an Amazon CloudFront distribution for the static content. Add an Amazon Simple Queue Service (Amazon SOS) queue to receive requests from the website for later processing by the EC2 instances.

Online Good AWS SAA-C02 Exam Free Questions

Online Good AWS SAA-C02 Exam Free Questions

Share this post

Leave a Reply Cancel reply

Related Posts