Question 1

- (Exam Topic 2)

A retail company needs to provide a series of data files to another company, which is its business partner These files are saved in an Amazon S3 bucket Account A. which belongs to the retail company. The business partner company wants one of its 1AM users. User\_DataProcessor. to access the files from it AWS account (Account B).

Which combination of steps must the companies take so that User\_DataProcessor can access the S3 bucket successfully? (Select TWO.)

Accepted Answer

https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-s3/

Question 2

- (Exam Topic 2)

A company needs to optimize the cost of backups for Amazon Elastic File System (Amazon EFS). A solutions architect has already configured a backup plan AWS Backup for the EFS backups. The backup plan contains a rule with a lifecycle configuration to transition EFS backups to cold storage after 7 days an keep the backups for an additional 90 days.

After I month, the company reviews its EFS storage costs and notices an increase in the EFS backup costs. The EFS backup cold storage produces almost do the cost of the EFS warm backup storage.

What should the solutions architect do to optimize the cost?

Certshared now are offering 100% pass ensure AWS-Certified-Solutions-Architect-Professional dumps!

https://www.certshared.com/exam/AWS-Certified-Solutions-Architect-Professional/ (300 Q&As)

Accepted Answer

The cost of EFS backup cold storage is $0.01 per GB-month, whereas the cost of EFS backup warm storage is $0.05 per GB-month1. Therefore, moving the backups to cold storage as soon as possible will reduce the storage cost. However, cold storage backups must be retained for a minimum of 90 day2s, othe they incur a pro-rated charge equal to the storage charge for the remaining days1. Therefore, setting the backup retention period to 30 days will incur 60 days of cold storage cost for each backup deleted. This penalty will still be lower than keeping the backups in warm storage for 7 days and then in c for 83 days, which is the current configuration. Therefore, option A is the most cost-effective solution.

Question 3

- (Exam Topic 2)

A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a statefu application. The application connects to a PostgreSQL database running on a separate server. The application's user base is expected to grow significant the company is migrating the application and database to AWS. The solution will use Amazon Aurora PostgreSQL, Amazon EC2 Auto Scaling, and Elastic Load Balancing.

Which solution will provide a consistent user experience that will allow the application and database tiers to scale?

Accepted Answer

Aurora Auto Scaling enables your Aurora DB cluster to handle sudden increases in connectivity or workload. When the connectivity or workload decreases, Auto Scaling removes unnecessary Aurora Replicas so that you don't pay for unused provisioned DB instances

Question 4

- (Exam Topic 2)

A company has VPC flow logs enabled for its NAT gateway. The company is seeing Action = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 destined for a private Amazon EC2 instance.

A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet. The first two octets of the VPC C are 203.0.

Which set of steps should the solutions architect take to meet these requirements?

Accepted Answer

https://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/ by Cloudxie says "select appropriate log"

Question 5

- (Exam Topic 2)

A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone. The company is concerned about security and solutions architect to re-architect the solution to meet the following requirements:

- Inbound requests must be filtered for common vulnerability attacks.
- Rejected requests must be sent to a third-party auditing application.
- All resources should be highly available. Which solution meets these requirements?

Accepted Answer

https://docs.aws.amazon.com/waf/latest/developerguide/marketplace-managed-rule-groups.html

Question 6

- (Exam Topic 2)

A solutions architect needs to improve an application that is hosted in the AWS Cloud. The application uses an Amazon Aurora MySQL DB instance that is experiencing overloaded connections. Most of the application's operations insert records into the database. The application currently stores credentials based configuration file.

The solutions architect needs to implement a solution so that the application can handle the current connection load. The solution must keep the credent and must provide the ability to rotate the credentials automatically on a regular basis. Which solution will meet these requirements?

Accepted Answer

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-proxy.html

Question 7

- (Exam Topic 2)

A company has an application in the AWS Cloud. The application runs on a fleet of 20 Amazon EC2 instances. The EC2 instances are persistent and store da multiple attached Amazon Elastic Block Store (Amazon EBS) volumes.

The company must maintain backups in a separate AWS Region. The company must be able to recover the EC2 instances and their configuration within I business day, with loss of no more than I day's worth of data. The company has limited staff and needs a backup solution that optimizes operational effi cost. The company already has created an AWS CloudFormation template that can deploy the required network configuration in a secondary Region. Which solution will meet these requirements?

Accepted Answer

Using AWS Backup to create a scheduled daily backup plan for the EC2 instances will enable taking snapshots of the EC2 instances and their attached EBS volumes1. Configuring the backup task to copy the backups to a vault in the secondary Region will enable maintaining backups in a separate Region1. In t of a failure, launching the CloudFormation template will enable deploying the network configuration in the secondary Region2. Restoring the instance vol configurations from the backup vault will enable recovering the EC2 instances and their data1. Transferring usage to the secondary Region will enable re operations2.

Question 8

- (Exam Topic 2)

A company needs to build a disaster recovery (DR) solution for its ecommerce website. The web application is hosted on a fleet of t3.Iarge Amazon EC2 in and uses an Amazon RDS for MySQL DB instance. The EC2 instances are in an Auto Scaling group that extends across multiple Availability Zones.

## Certshared now are offering 100% pass ensure AWS-Certified-Solutions-Architect-Professional dumps!

https://www.certshared.com/exam/AWS-Certified-Solutions-Architect-Professional/ (300 Q&As)

In the event of a disaster, the web application must fail over to the secondary environment with an RPO of 30 seconds and an R TO of 10 minutes. Which solution will meet these requirements MOST cost-effectively?

Accepted Answer

The company should use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. The company should create a cross-Region read replica for the DB instance. The company should set up AWS Elastic Disaster Recovery to continuously replicate the EC2 instances to the DR Region. The company should run the EC2 instances at the minimum capacity in the DR Region. The company should use an Amazon Route 53 failover routing policy to automatically fail over to the DR Region in the event of a disaster. The company should increase the desired capacity of the Auto Scaling group. This so meet the requirements most cost-effectively because AWS Elastic Disaster Recovery (AWS DRS) is a service that minimizes downtime and data loss with fast reliable recovery of on-premises and cloud-based applications using affordable storage, minimal compute, and point-in-time recovery. AWS DRS enables RPO seconds and RTOs of minute1s. AWS DRS continuously replicates data from the source servers to a staging area subnet in the DR Region, where it uses lowstorage and minimal compute resources to maintain ongoing replication. In the event of a disaster, AWS DRS automatically converts the servers to boot an natively on AWS and launches recovery instances on AWS within minutes2. By using AWS DRS, the company can save costs by removing idle recovery site resources and paying for the full disaster recovery site only when needed. By creating a cross-Region read replica for the DB instance, the company can standby copy of its primary database in a different AWS Region3. By using infrastructure as code (IaC), the company can provision the new infrastructure DR Region in an automated and consistent way4. By using an Amazon Route 53 failover routing policy, the company can route traffic to a resource that is or to another resource when the first resource becomes unavailable. The other options are not correct because: - Using AWS Backup to create cross-Region backups for the EC2 instances and the DB instance would not meet the RPO and RTO requirements. AWS Backup is a service that enables you to centralize and automate data protection across AWS services. You can use AWS Backup to back up your application data ac AWS services in your account and across accounts. However, AWS Backup does not provide continuous replication or fast recovery; it creates backups at scheduled intervals and requires manual restoration. Creating backups every 30 se would also incur high costs and network bandwidth. - Creating an Amazon API Gateway Data API service integration with Amazon Redshift would not help with disaster recovery. The Data API is a feature th enables you to query your Amazon Redshift cluster using HTTP requests, without needing a persistent connection or a SQL client. It is useful for buildin applications that interact with Amazon Redshift, but not for replicating or recovering data. - Creating an AWS Data Exchange datashare by connecting AWS Data Exchange to the Redshift cluster would not help with disaster recovery. AWS Data Exchange is a service that makes it easy for AWS customers to exchange data in the cloud. You can use AWS Data Exchange to subscribe to a diverse select of third-party data products or offer your own data products to other AWS customers. A datashare is a feature that enables you to share live and secure your Amazon Redshift data across your accounts or with third parties without copying or moving the underlying data. It is useful for sharing query resul with other users, but not for replicating or recovering data. ## References: - https://aws.amazon.com/disaster-recovery/ - https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html - https://aws.amazon.com/cloudformation/ - https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html - https://aws.amazon.com/backup/ - https://docs.aws.amazon.com/redshift/latest/mgmt/data-api.html - https://aws.amazon.com/data-exchange/ - https://docs.aws.amazon.com/redshift/latest/dg/datashare-overview.html

Question 9

- (Exam Topic 2)

A company is designing a new website that hosts static content. The website will give users the ability to upload and download large files. According to requirements, all data must be encrypted in transit and at rest. A solutions architect is building the solution by using Amazon S3 and Amazon CloudFront Which combination of steps will meet the encryption requirements? (Select THREE.)

Accepted Answer

Turning on S3 server-side encryption for the S3 bucket that the web application uses will enable encrypting the data at rest using Amazon S3 managed key S3)1. Creating a bucket policy that denies any unencrypted operations in the S3 bucket that the web application uses will enable enforcing encryption fo requests to the bucket2. Configuring redirection of HTTP requests to HTTPS requests in CloudFront will enable encrypting the data in transit using SSL/T

Question 10

- (Exam Topic 2)

A company runs an loT application in the AWS Cloud. The company has millions of sensors that collect data from houses in the United States. The sensors the MOTT protocol to connect and send data to a custom MQTT broker. The MQTT broker stores the data on a single Amazon EC2 instance. The sensors connect to the broker through the domain named iot.example.com. The company uses Amazon Route 53 as its DNS service. The company stores the data in Amazon DynamoDB.

On several occasions, the amount of data has overloaded the MOTT broker and has resulted in lost sensor data. The company must improve the reliability o solution.

Which solution will meet these requirements?

Accepted Answer

it describes a solution that uses an Application Load Balancer (ALB) and an Auto Scaling group for the MQTT broker. The ALB distributes incoming traffic the instances in the Auto Scaling group and allows for automatic scaling based on incoming traffic. The use of an alias record in Route 53 allows for ea to the DNS record without changing the IP address. This solution improves the reliability of the MQTT broker by allowing it to automatically scale based incoming traffic, reducing the likelihood of lost data due to broker overload.

Reference: https://aws.amazon.com/elasticloadbalancing/applicationloadbalancer/ https://aws.amazon.com/autoscaling/ https://aws.amazon.com/route53/