Question 1

- (Topic 4)
- A solutions architect needs to design the architecture for an application that a vendor provides as a Docker container image The container needs 50 GB o available for temporary files The infrastructure must be serverless.

Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

The AWS Fargate launch type is a serverless way to run containers on Amazon ECS, without having to manage any underlying infrastructure. You only pay for the resources required to run your containers, and AWS handles the provisioning scaling, and security of the cluster. Amazon EFS is a fully managed, elastic, and scalable file system that can be mounted to multiple containers, and p availability and durability. By using AWS Fargate and Amazon EFS, you can run your Docker container image with 50 GB of storage available for temporary with the least operational overhead. This solution meets the requirements of the question.

## References:

- ? AWS Fargate
- ? Amazon Elastic File System
- ? Using Amazon EFS file systems with Amazon ECS

Question 2

- (Topic 4)

A company has a business-critical application that runs on Amazon EC2 instances. The application stores data in an Amazon DynamoDB table. The company must be able to revert the table to any point within the last 24 hours.

Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Point-in-time recovery (PITR) for DynamoDB is a feature that enables you to restore your table data to any point in time during the last 35 days. PITR protect your table from accidental write or delete operations, such as a test script writing to a production table or a user issuing a wrong command. PI use, fully managed, fast, and scalable. You can enable PITR with a single click in the DynamoDB console or with a simple API call. You can restore a tab new table using the console, the AWS CLI, or the DynamoDB API. PITR does not consume any provisioned table capacity and has no impact on the performance or availability of your production applications. PITR meets the requirements of the company with the least operational overhead, as it does not require backup creation, scheduling, or maintenance. It also provides per-second granularity for restoring the table to any point within the last 24 hours.

## References:

- ? Point-in-time recovery for DynamoDB - Amazon DynamoDB
- ? Amazon DynamoDB point-in-time recovery (PITR)
- ? Enable Point-in-Time Recovery (PITR) for Dynamodb global tables
- ? Restoring a DynamoDB table to a point in time - Amazon DynamoDB
- ? Point-in-time recovery: How it works - Amazon DynamoDB

Question 3

- (Topic 4)

A company is creating an application that runs on containers in a VPC. The application stores and accesses data in an Amazon S3 bucket During the develo phase, the application will store and access 1 TB of data in Amazon S3 each day. The company wants to minimize costs and wants to prevent traffic from traversing the internet whenever possible.

Which solution will meet these requirements?

Accepted Answer

A gateway VPC endpoint for Amazon S3 enables private connections between the VPC and Amazon S3 that do not require an internet gateway or NAT device. This minimizes costs and prevents traffic from traversing the internet. A gateway VPC endpoint uses a prefix list as the route target in a VPC route tab traffic privately to Amazon S31. Associating the endpoint with all route tables in the VPC ensures that all subnets can access Amazon S3 through the end Option A is incorrect because S3 Intelligent-Tiering is a storage class that optimizes storage costs by automatically moving objects between two access on changing access patterns. It does not affect the network traffic between the VPC and Amazon S32.

Option B is incorrect because S3 Transfer Acceleration is a feature that enables fast, easy, and secure transfers of files over long distances between c an S3 bucket. It does not prevent traffic from traversing the internet3.

## Recommend!! Get the Full AWS-Solution-Architect-Associate dumps in VCE and PDF From SurePassExam

https://www.surepassexam.com/AWS-Solution-Architect-Associate-exam-dumps.html (551 New Questions)

Option D is incorrect because an interface VPC endpoint for Amazon S3 is powered by AWS PrivateLink, which requires an elastic network interface (ENI) w private IP address in each subnet. This adds complexity and cost to the solution. Moreover, an interface VPC endpoint does not support cross-Region acce Amazon S3. Reference URL: 1: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html 2:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc- dynamic-data-access 3:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html : https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpointstrategy-for- amazon-s3/

Question 4

- (Topic 4)

An ecommerce company is running a seasonal online sale. The company hosts its website on Amazon EC2 instances spanning multiple Availability Zones. The company wants its website to manage sudden traffic increases during the sale.

Which solution will meet these requirements MOST cost-effectively?

Accepted Answer

The solution that meets the requirements of high availability, resiliency, and minimal operational effort is to use AWS Transfer for SFTP and an Amazon for storage. This solution allows the company to securely transfer files over SFTP to Amazon S3, which is a durable and scalable object storage service. company can then modify the application to pull the batch files from Amazon S3 to an Amazon EC2 instance for processing. The EC2 instance can be part of Auto Scaling group with a scheduled scaling policy to run the batch operation only at night. This way, the company can save costs by scaling down the EC instances when they are not needed. The other solutions do not meet all the requirements because they either use Amazon EFS or Amazon EBS for storage, which are more expensive and less scalable than Amazon S3, or they do not use a scheduled scaling policy to optimize the EC2 instances usage. References

- ? AWS Transfer for SFTP
- ? Amazon S3
- ? Amazon EC2 Auto Scaling

Question 5

- (Topic 4)

A company containerized a Windows job that runs on .NET 6 Framework under a Windows container. The company wants to run this job in the AWS Cloud. The job runs every 10 minutes. The job's runtime varies between 1 minute and 3 minutes.

Which solution will meet these requirements MOST cost-effectively?

Accepted Answer

AWS Lambda supports container images as a packaging format for functions. You can use existing container development workflows to package and deploy Lambda functions as container images of up to 10 GB in size. You can also use familiar tools such as Docker CLI to build, test, and push your container Amazon Elastic Container Registry (Amazon ECR). You can then create an AWS Lambda function based on the container image of your job and configure Amazon EventBridge to invoke the function every 10 minutes using a cron expression. This solution will be cost-effective as you only pay for the compute consume when your function runs. References: https://docs.aws.amazon.com/lambda/latest/dg/images-create.html https://docs.aws.amazon.com/eventbridge/latest/userguide/run-lambda-schedule.html

Question 6

- (Topic 4)

A solutions architect is designing a highly available Amazon ElastiCache for Redis based solution. The solutions architect needs to ensure that failures result in performance degradation or loss of data locally and within an AWS Region. The solution needs to provide high availability at the node level an Region level.

Which solution will meet these requirements?

Accepted Answer

This answer is correct because it provides high availability at the node level and at the Region level for the ElastiCache for Redis solution. A Multireplication group consists of a primary cluster and up to five read replica clusters, each in a different Availability Zone. If the primary cluster fail

## Recommend!! Get the Full AWS-Solution-Architect-Associate dumps in VCE and PDF From SurePassExam

https://www.surepassexam.com/AWS-Solution-Architect-Associate-exam-dumps.html (551 New Questions)

replicas is automatically promoted to be the new primary cluster. A Redis replication group with shards enables partitioning of the data across multiple which increases the scalability and performance of the solution. Each shard can have one or more replicas to provide redundancy and read scaling. References:

- ? https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/AutoFailover.html
- ? https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Shards.html

Question 7

- (Topic 4)

A financial company needs to handle highly sensitive data The company will store the data in an Amazon S3 bucket The company needs to ensure that the da encrypted in transit and at rest The company must manage the encryption keys outside the AWS Cloud Which solution will meet these requirements?

Accepted Answer

This option is the only solution that meets the requirements because it allows the company to encrypt the data with its own encryption keys and tools o AWS Cloud. By encrypting the data at the company's data center before storing the data in the S3 bucket, the company can ensure that the data is encrypt transit and at rest, and that the company has full control over the encryption keys and processes. This option also avoids the need to use any AWS encry services or features, which may not be compatible with the company's security policies or compliance standards.

* A. Encrypt the data in the S3 bucket with server-side encryption (SSE) that uses an AWS Key Management Service (AWS KMS) customer managed key. This option does not meet the requirements because it does not allow the company to manage the encryption keys outside the AWS Cloud. Although the company ca create and use its own customer managed key in AWS KMS, the key is still stored and managed by AWS KMS, which is a service within the AWS Cloud. Moreover, the company still needs to use the AWS encryption features and APIs to encrypt and decrypt the data in the S3 bucket, which may not be compati with the company's security policies or compliance standards.
* B. Encrypt the data in the S3 bucket with server-side encryption (SSE) that uses an AWS Key Management Service (AWS KMS) AWS managed key. This option does not meet the requirements because it does not allow the company to manage the encryption keys outside the AWS Cloud. In this option, the company us the default AWS managed key in AWS KMS, which is created and managed by AWS on behalf of the company. The company has no control over the key rotation, deletion, or recovery policies. Moreover, the company still needs to use the AWS encryption features and APIs to encrypt and decrypt the data in the S3 which may not be compatible with the company's security policies or compliance standards.
* C. Encrypt the data in the S3 bucket with the default server-side encryption (SSE). This option does not meet the requirements because it does not all company to manage the encryption keys outside the AWS Cloud. In this option, the company uses the default server-side encryption with Amazon S3 managed keys (SSE-S3), which is applied to every bucket in Amazon S3. The company has no visibility or control over the encryption keys, which are managed by Am S3. Moreover, the company still needs to use the AWS encryption features and APIs to encrypt and decrypt the data in the S3 bucket, which may not be compatible with the company's security policies or compliance standards. References:
- ? 1 Protecting data with encryption - Amazon Simple Storage Service
- ? 2 Protecting data with server-side encryption - Amazon Simple Storage Service
- ? 3 Protecting data by using client-side encryption - Amazon Simple Storage Service
- ? 4 AWS Key Management Service Concepts - AWS Key Management Service

Question 8

- (Topic 4)

An image hosting company uploads its large assets to Amazon S3 Standard buckets The company uses multipart upload in parallel by using S3 APIs and overwrites if the same object is uploaded again. For the first 30 days after upload, the objects will be accessed frequently. The objects will be used l after 30 days, but the access patterns for each object will be inconsistent The company must optimize its S3 storage costs while maintaining high availa resiliency of stored assets.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Accepted Answer

S3 Intelligent-Tiering is a storage class that automatically moves data to the most cost-effective access tier based on access frequency, without perfo impact, retrieval fees, or operational overhead1. It is ideal for data with unknown or changing access patterns, such as the company's assets. By moving S3 Intelligent-Tiering after 30 days, the company can optimize its storage costs while maintaining high availability and resilience of stored assets.

S3 Lifecycle is a feature that enables you to manage your objects so that they are stored cost effectively throughout their lifecycle2. You can create l to define actions that Amazon S3 applies to a group of objects. One of the actions is to abort incomplete multipart uploads that can occur when an uploa interrupted. By configuring an S3 Lifecycle policy to clean up incomplete multipart uploads, the company can reduce its storage costs and avoid paying f that are not used.

Option C is incorrect because expired object delete markers are automatically deleted by Amazon S3 and do not incur any storage costs3. Therefore, confi an S3 Lifecycle policy to clean up expired object delete markers will not have any effect on the company's storage costs.

Option D is incorrect because S3 Standard-IA is a storage class for data that is accessed less frequently, but requires rapid access when needed1. It ha storage cost than S3 Standard, but it has a higher retrieval cost and a minimum storage duration charge of 30 days. Therefore, moving assets to S3 Stand after 30 days may not optimize the company's storage costs if the assets are still accessed occasionally.

Option E is incorrect because S3 One Zone-IA is a storage class for data that is accessed less frequently, but requires rapid access when needed1. It ha storage cost than S3 Standard-IA, but it stores data in only one Availability Zone and has less resilience than other storage classes. It also has a hig cost and a minimum storage duration charge of 30 days. Therefore, moving assets to S3 One Zone-IA after 30 days may not optimize the company's storage costs if the assets are still accessed occasionally or require high availability. Reference URL: 1: https://docs.aws.amazon.com/AmazonS3/latest/userguid class-intro.html 2:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html 3: https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-orempty- bucket.html#delete-bucket-considerations : https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html :

https://aws.amazon.com/certification/certified-solutions-architect-associate/

Question 9

- (Topic 4)

A company has users all around the world accessing its HTTP-based application deployed on Amazon EC2 instances in multiple AWS Regions. The company wants to improve the availability and performance of the application. The company also wants to protect the application against common web exploits that affect availability, compromise security, or consume excessive resources. Static IP addresses are required. What should a solutions architect recommend to accomplish this?

Accepted Answer

The company wants to improve the availability and performance of the application, as well as protect it against common web exploits. The company also n static IP addresses for the application. To meet these requirements, a solutions architect should recommend the following solution:

- ? Put the EC2 instances behind Network Load Balancers (NLBs) in each Region.

NLBs are designed to handle millions of requests per second while maintaining high throughput at ultra-low latency. NLBs also support static IP addresse each Availability Zone, which can be useful for whitelisting or firewalling purposes.

- ? Deploy AWS WAF on the NLBs. AWS WAF is a web application firewall that helps

protect web applications from common web exploits that could affect availability, security, or performance. AWS WAF lets you define customizable web sec rules that control which traffic to allow or block to your web applications.

- ? Create an accelerator using AWS Global Accelerator and register the NLBs as
- endpoints. AWS Global Accelerator is a service that improves the availability and performance of your applications with local or global users. It provid addresses that act as a fixed entry point to your application endpoints in any AWS Region. It uses the AWS global network to optimize the path from your your applications, improving the performance of your TCP and UDP traffic.

This solution will provide high availability across Availability Zones and Regions, improve performance by routing traffic over the AWS global network, application from common web attacks, and provide static IP addresses for the application.

References:

- ? Network Load Balancer
- ? AWS WAF
- ? AWS Global Accelerator

Question 10

- (Topic 4)

A company hosts a multi-tier web application on Amazon Linux Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scal group across multiple Availability Zones. The company observes that the Auto Scaling group launches more On-Demand Instances when the application's end users access high volumes of static web content. The company wants to optimize cost.

What should a solutions architect do to redesign the application MOST cost-effectively?

Accepted Answer

This answer is correct because it meets the requirements of optimizing cost and reducing the workload on the database. Amazon CloudFront is a content de network (CDN) service that speeds up distribution of your static and dynamic web content, such as .html,.css, .js, and image files, to your users. Cloud delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with CloudFron request is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance. Y an Amazon CloudFront distribution to host the static web contents from an Amazon S3 bucket, which is an origin that you define for CloudFront. This way, offload the requests for static web content from your EC2 instances to CloudFront, which can improve the performance and availability of your website, a the cost of running your EC2 instances.

References:

- ? https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introducti on.html
- ? https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html