Question 1

- (Topic 4)

A company has two VPCs named Management and Production. The Management VPC uses VPNs through a customer gateway to connect to a single device in the data center. The Production VPC uses a virtual private gateway AWS Direct Connect connections. The Management and Production VPCs both use a single VPC peering connection to allow communication between the

What should a solutions architect do to mitigate any single point of failure in this architecture?

Accepted Answer

This answer is correct because it provides redundancy for the VPN connection between the Management VPC and the data center. If one customer gateway device or one VPN tunnel becomes unavailable, the traffic can still flow over the second customer gateway device and the second VPN tunnel. This way, th single point of failure in the VPN connection is mitigated. References:

- ? https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-redundant-connection.html
- ? https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/VPC/vpn-tunnel-redundancy.html

Question 2

- (Topic 4)

A company wants to use an AWS CloudFormatlon stack for its application in a test environment. The company stores the CloudFormation template in an Amazo S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user requests t create the test environment The solution must follow security best practices.

Which solution will meet these requirements?

Accepted Answer

it allows CloudFormation to access the template in the S3 bucket without granting public access or creating additional resources. A presigned URL is a signed with the access key of an IAM user or role that has permission to access the object. The presigned URL can be used by anyone who receives it, but expires after a specified time. By creating a presigned URL for the template object and configuring the CloudFormation stack to use it, the company can CloudFormation access to the template based on specific user requests and follow security best practices. References:

- ? Using Amazon S3 Presigned URLs
- ? Using Amazon S3 Buckets

Question 3

- (Topic 4)

A company is moving its data and applications to AWS during a multiyear migration project. The company wants to securely access data on Amazon S3 from t company's AWS Region and from the company's on-premises location. The data must not traverse the internet. The company has established an AWS Direct Connect connection between its Region and its on-premises location

Which solution will meet these requirements?

Accepted Answer

A gateway endpoint is a gateway that is a target for a specified route in your route table, used for traffic destined to a supported AWS service1. Amaz not support gateway endpoints, only interface endpoints2. Therefore, option A is incorrect. An interface endpoint is an elastic network interface with a private IP address that serves as an entry point for traffic destined to a supported servic endpoint can provide secure access to Amazon S3 from within the Region, but not from the on-premises location. Therefore, option C is incorrect. AWS Key Management Service (AWS KMS) is a service that allows you to create and manage encryption keys to protect your data3. AWS KMS does not provide a way to access data on Amazon S3 without traversing the internet. Therefore, option D is incorrect. AWS Transit Gateway is a service that enables you t your Amazon Virtual Private Clouds (VPCs) and your on-premises networks to a single gateway. You can create a gateway in AWS Transit Gateway to access Amazon S3 securely from both the Region and the on-premises location using AWS Direct Connect. Therefore, option B is correct.

Question 4

- (Topic 4)

A solutions architect wants to use the following JSON text as an identity-based policy to grant specific permissions:

```
"statement": "Action":[ "ssm:ListDocuments" "ssm:GetDocument" "Effect":"Allow" "Resource "sid": "version":"2012-10-17"
```

Which IAM principals can the solutions architect attach this policy to? (Select TWO.)

Accepted Answer

This JSON text is an identity-based policy that grants specific permissions. The IAM principals that the solutions architect can attach this policy to a Group. This is because the policy is written in JSON and is an identity-based policy, which can be attached to IAM principals such as users, groups, and Identity-based policies are permissions policies that you attach to IAM identities (users, groups, or roles) and explicitly state what that identity is to do1. Identity-based policies are different from resource-based policies, which define the permissions around the specific resource1. Resource-based p attached to a resource, such as an Amazon S3 bucket or an Amazon EC2 instance1. Resource-based policies can also specify a principal, which is the entit is allowed or denied access to the resource1. Organization is not an IAM principal, but a feature of AWS Organizations that allows you to manage multipl accounts centrally2. Amazon ECS resource and Amazon EC2 resource are not IAM principals, but AWS resources that can have resource-based policies attache to them34. References:

- ? Identity-based policies and resource-based policies
- ? AWS Organizations
- ? Amazon ECS task role
- ? Amazon EC2 instance profile

Question 5

- (Topic 4)

A company is building a shopping application on AWS. The application offers a catalog that changes once each month and needs to scale with traffic volum company wants the lowest possible latency from the application. Data from each user's shopping carl needs to be highly available. User session data must available even if the user is disconnected and reconnects.

What should a solutions architect do to ensure that the shopping cart data is preserved at all times?

Accepted Answer

To ensure that the shopping cart data is preserved at all times, a solutions architect should configure Amazon ElastiCache for Redis to cache catalog da Amazon DynamoDB and shopping cart data from the user's session. This solution has the following benefits:

- ? It offers the lowest possible latency from the application, as ElastiCache for Redis

is a blazing fast in-memory data store that provides sub-millisecond latency to power internet-scale real-time applications1.

? It scales with traffic volume, as ElastiCache for Redis supports horizontal scaling by adding more nodes or shards to the cluster, and vertical scaling by changing the node type2.

? It is highly available, as ElastiCache for Redis supports replication across multiple

Availability Zones and automatic failover in case of a primary node failure3.

- ? It preserves user session data even if the user is disconnected and reconnects, as ElastiCache for Redis can store session data, such as user login in and shopping cart contents, in a persistent and durable manner using snapshots or AOF (append-only file) persistence4.

References:

- ? 1: https://aws.amazon.com/elasticache/redis/
- ? 2: https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Scaling.html
- ? 3: https://docs.aws.amazon.com/AmazonElastiCache/latest/red- ug/Replication.html
- ? 4: https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups.html

Question 6

## - (Topic 4)

A social media company runs its application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is the origin for an Amazon CloudFront distribution. The application has more than a billion images stored in an Amazon S3 bucket and processes thousands of images each second. The company wants to resize the images dynamically and serve appropriate formats to clients.

Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

Lambda@Edge is a service that allows you to run Lambda functions at CloudFront edge locations. It can be used to modify requests and responses that flo through CloudFront. CloudFront origin request policy is a policy that controls the values (URL query strings, HTTP headers, and cookies) that are includ requests that CloudFront sends to the origin. It can be used to collect additional information at the origin or to customize the origin response. CloudF headers policy is a policy that specifies the HTTP headers that CloudFront removes or adds in responses that it sends to viewers. It can be used to add custom headers to responses.

Based on these definitions, the solution that will meet the requirements with the least operational overhead is:

* C. Use a Lambda@Edge function with an external image management library. Associate the Lambda@Edge function with the CloudFront behaviors that serve the images.

This solution would allow the application to use a Lambda@Edge function to resize the images dynamically and serve appropriate formats to clients based User-Agent HTTP header in the request. The Lambda@Edge function would run at the edge locations, reducing latency and load on the origin. The application code would only need to include an external image management library that can perform image manipulation tasks1.

Question 7

- (Topic 4)

A solutions architect is designing a highly available Amazon ElastiCache for Redis based solution. The solutions architect needs to ensure that failures result in performance degradation or loss of data locally and within an AWS Region. The solution needs to provide high availability at the node level an Region level.

Which solution will meet these requirements?

Accepted Answer

This answer is correct because it provides high availability at the node level and at the Region level for the ElastiCache for Redis solution. A Multireplication group consists of a primary cluster and up to five read replica clusters, each in a different Availability Zone. If the primary cluster fail replicas is automatically promoted to be the new primary cluster. A Redis replication group with shards enables partitioning of the data across multiple which increases the scalability and performance of the solution. Each shard can have one or more replicas to provide redundancy and read scaling. References:

? https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/AutoFailover.html

- ? https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Shards.html

Question 8

- (Topic 4)

A financial company needs to handle highly sensitive data The company will store the data in an Amazon S3 bucket The company needs to ensure that the da encrypted in transit and at rest The company must manage the encryption keys outside the AWS Cloud

Which solution will meet these requirements?

Accepted Answer

This option is the only solution that meets the requirements because it allows the company to encrypt the data with its own encryption keys and tools o AWS Cloud. By encrypting the data at the company's data center before storing the data in the S3 bucket, the company can ensure that the data is encrypt transit and at rest, and that the company has full control over the encryption keys and processes. This option also avoids the need to use any AWS encry services or features, which may not be compatible with the company's security policies or compliance standards.

* A. Encrypt the data in the S3 bucket with server-side encryption (SSE) that uses an AWS Key Management Service (AWS KMS) customer managed key. This option does not meet the requirements because it does not allow the company to manage the encryption keys outside the AWS Cloud. Although the company ca create and use its own customer managed key in AWS KMS, the key is still stored and managed by AWS KMS, which is a service within the AWS Cloud. Moreover, the company still needs to use the AWS encryption features and APIs to encrypt and decrypt the data in the S3 bucket, which may not be compati with the company's security policies or compliance standards.
* B. Encrypt the data in the S3 bucket with server-side encryption (SSE) that uses an AWS Key Management Service (AWS KMS) AWS managed key. This option does not meet the requirements because it does not allow the company to manage the encryption keys outside the AWS Cloud. In this option, the company us

## Recommend!! Get the Full AWS-Solution-Architect-Associate dumps in VCE and PDF From SurePassExam

https://www.surepassexam.com/AWS-Solution-Architect-Associate-exam-dumps.html (551 New Questions)

the default AWS managed key in AWS KMS, which is created and managed by AWS on behalf of the company. The company has no control over the key rotation, deletion, or recovery policies. Moreover, the company still needs to use the AWS encryption features and APIs to encrypt and decrypt the data in the S3 which may not be compatible with the company's security policies or compliance standards.

* C. Encrypt the data in the S3 bucket with the default server-side encryption (SSE). This option does not meet the requirements because it does not all company to manage the encryption keys outside the AWS Cloud. In this option, the company uses the default server-side encryption with Amazon S3 managed keys (SSE-S3), which is applied to every bucket in Amazon S3. The company has no visibility or control over the encryption keys, which are managed by Am S3. Moreover, the company still needs to use the AWS encryption features and APIs to encrypt and decrypt the data in the S3 bucket, which may not be compatible with the company's security policies or compliance standards. References:
- ? 1 Protecting data with encryption - Amazon Simple Storage Service
- ? 2 Protecting data with server-side encryption - Amazon Simple Storage Service
- ? 3 Protecting data by using client-side encryption - Amazon Simple Storage Service
- ? 4 AWS Key Management Service Concepts - AWS Key Management Service

Question 9

- (Topic 4)

A company has users all around the world accessing its HTTP-based application deployed on Amazon EC2 instances in multiple AWS Regions. The company wants to improve the availability and performance of the application. The company also wants to protect the application against common web exploits that affect availability, compromise security, or consume excessive resources. Static IP addresses are required.

What should a solutions architect recommend to accomplish this?

Accepted Answer

The company wants to improve the availability and performance of the application, as well as protect it against common web exploits. The company also n static IP addresses for the application. To meet these requirements, a solutions architect should recommend the following solution:

? Put the EC2 instances behind Network Load Balancers (NLBs) in each Region.

NLBs are designed to handle millions of requests per second while maintaining high throughput at ultra-low latency. NLBs also support static IP addresse each Availability Zone, which can be useful for whitelisting or firewalling purposes.

- ? Deploy AWS WAF on the NLBs. AWS WAF is a web application firewall that helps protect web applications from common web exploits that could affect availability, security, or performance. AWS WAF lets you define customizable web sec rules that control which traffic to allow or block to your web applications.
- ? Create an accelerator using AWS Global Accelerator and register the NLBs as

endpoints. AWS Global Accelerator is a service that improves the availability and performance of your applications with local or global users. It provid addresses that act as a fixed entry point to your application endpoints in any AWS Region. It uses the AWS global network to optimize the path from your your applications, improving the performance of your TCP and UDP traffic.

This solution will provide high availability across Availability Zones and Regions, improve performance by routing traffic over the AWS global network, application from common web attacks, and provide static IP addresses for the application.

References:

- ? Network Load Balancer
- ? AWS WAF
- ? AWS Global Accelerator

Question 10

- (Topic 4)

A company hosts a multi-tier web application on Amazon Linux Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scal group across multiple Availability Zones. The company observes that the Auto Scaling group launches more On-Demand Instances when the application's end users access high volumes of static web content. The company wants to optimize cost.

What should a solutions architect do to redesign the application MOST cost-effectively?

Accepted Answer

This answer is correct because it meets the requirements of optimizing cost and reducing the workload on the database. Amazon CloudFront is a content de network (CDN) service that speeds up distribution of your static and dynamic web content, such as .html,.css, .js, and image files, to your users. Cloud delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with CloudFron request is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance. Y an Amazon CloudFront distribution to host the static web contents from an Amazon S3 bucket, which is an origin that you define for CloudFront. This way, offload the requests for static web content from your EC2 instances to CloudFront, which can improve the performance and availability of your website, a the cost of running your EC2 instances.

References:

- ? https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introducti on.html
- ? https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html