Filters
Question type

Study Flashcards

A company wants a storage option that enables its data science team to analyze its data on premises and in the AWS Cloud. The team needs to be able to run statistical analyses by using the data on premises and by using a fleet of Amazon EC2 instances across multiple Availability Zones. What should a solutions architect do to meet these requirements?


A) Use an AWS Storage Gateway tape gateway to copy the on-premises files into Amazon S3.
B) Use an AWS Storage Gateway volume gateway to copy the on-premises files into Amazon S3.
C) Use an AWS Storage Gateway file gateway to copy the on-premises files to Amazon Elastic Block Store (Amazon EBS) .
D) Attach an Amazon Elastic File System (Amazon EFS) file system to the on-premises servers. Copy the files to Amazon EFS.

E) A) and D)
F) C) and D)

Correct Answer

verifed

verified

A company needs to provide its employees with secure access to confidential and sensitive files. The company wants to ensure that the files can be accessed only by authorized users. The files must be downloaded securely to the employees' devices. The files are stored in an on-premises Windows file server. However, due to an increase in remote usage, the file server is running out of capacity. Which solution will meet these requirements?


A) Migrate the file server to an Amazon EC2 instance in a public subnet. Configure the security group to limit inbound traffic to the employees' IP addresses.
B) Migrate the files to an Amazon FSx for Windows File Server file system. Integrate the Amazon FSx file system with the on-premises Active Directory. Configure AWS Client VPN.
C) Migrate the files to Amazon S3, and create a private VPC endpoint. Create a signed URL to allow download.
D) Migrate the files to Amazon S3, and create a public VPC endpoint. Allow employees to sign on with AWS Single Sign-On.

E) C) and D)
F) A) and B)

Correct Answer

verifed

verified

A company has multiple applications that use Amazon RDS for MySQL as is database. The company recently discovered that a new custom reporting application has increased the number of Queries on the database. This is slowing down performance. How should a solutions architect resolve this issue with the LEAST amount of application changes?


A) Add a secondary DB instance using Multi-AZ.
B) Set up a road replica and Multi-AZ on Amazon RDS.
C) Set up a standby replica and Multi-AZ on Amazon RDS.
D) Use caching on Amazon RDS to improve the overall performance.

E) C) and D)
F) B) and C)

Correct Answer

verifed

verified

A company wants to migrate a workload to AWS. The chief information security officer requires that all data be encrypted at rest when stored in the cloud. The company wants complete control of encryption key lifecycle management. The company must be able to immediately remove the key material and audit key usage independently of AWS CloudTrail. The chosen services should integrate with other storage services that will be used on AWS. Which services satisfies these security requirements?


A) AWS CloudHSM with the CloudHSM client
B) AWS Key Management Service (AWS KMS) with AWS CloudHSM
C) AWS Key Management Service (AWS KMS) with an external key material origin
D) AWS Key Management Service (AWS KMS) with AWS managed customer master keys (CMKs)

E) A) and B)
F) None of the above

Correct Answer

verifed

verified

A company has recently updated its internal security standards. The company must now ensure all Amazon S3 buckets and Amazon Elastic Block Store (Amazon EBS) volumes are encrypted with keys created and periodically rotated by internal security specialists. The company is looking for a native, software-based AWS service to accomplish this goal.   What should a solutions architect recommend as a solution?


A) Use AWS Secrets Manager with customer master keys (CMKs) to store master key material and apply a routine to create a new CMK periodically and replace it in AWS Secrets Manager.
B) Use AWS Key Management Service (AWS KMS) with customer master keys (CMKs) to store master key material and apply a routine to re-create a new key periodically and replace it in AWS KMS.
C) Use an AWS CloudHSM cluster with customer master keys (CMKs) to store master key material and apply a routine to re-create a new key periodically and replace it in the CloudHSM cluster nodes.
D) Use AWS Systems Manager Parameter Store with customer master keys (CMKs) to store master key material and apply a routine to re-create a new key periodically and replace it in the Parameter Store.

E) None of the above
F) B) and C)

Correct Answer

verifed

verified

A company runs an application on a group of Amazon Linux EC2 instances. The application writes log files using standard API calls. For compliance reasons, all log files must be retained indefinitely and will be analyzed by a reporting tool that must access all files concurrently. Which storage service should a solutions architect use to provide the MOST cost-effective solution?


A) Amazon EBS
B) Amazon EFS
C) Amazon EC2 instance store
D) Amazon S3

E) A) and D)
F) None of the above

Correct Answer

verifed

verified

A company has global users accessing an application deployed in different AWS Regions, exposing public static IP addresses. The users are experiencing poor performance when accessing the application over the internet. What should a solutions architect recommend to reduce internet latency?


A) Set up AWS Global Accelerator and add endpoints.
B) Set up AWS Direct Connect locations in multiple Regions.
C) Set up an Amazon CloudFront distribution to access an application.
D) Set up an Amazon Route 53 geoproximity routing policy to route traffic.

E) None of the above
F) A) and D)

Correct Answer

verifed

verified

A company hosts an application on multiple Amazon EC2 instances. The application processes messages from an Amazon SQS queue, writes for an Amazon RDS table, and deletes the message from the queue. Occasional duplicate records are found in the RDS table. The SQS queue does not contain any duplicate messages. What should a solutions architect do to ensure messages are being processed once only?


A) Use the CreateQueue API call to create a new queue.
B) Use the AddPermission API call to add appropriate permissions.
C) Use the ReceiveMessage API call to set an appropriate wait time.
D) Use the ChangeMessageVisibility API call to increase the visibility timeout.

E) A) and C)
F) A) and B)

Correct Answer

verifed

verified

A company has two AWS accounts: Production and Development. There are code changes ready in the Development account to push to the Production account. In the alpha phase, only two senior developers on the development team need access to the Production account. In the beta phase, more developers might need access to perform testing as well. What should a solutions architect recommend?


A) Create two policy documents using the AWS Management Console in each account. Assign the policy to developers who need access.
B) Create an IAM role in the Development account. Give one IAM role access to the Production account. Allow developers to assume the role.
C) Create an IAM role in the Production account with the trust policy that specifies the Development account. Allow developers to assume the role.
D) Create an IAM group in the Production account and add it as a principal in the trust policy that specifies the Production account. Add developers to the group.

E) None of the above
F) A) and D)

Correct Answer

verifed

verified

A company wants to deploy a shared file system for its .NET application servers and Microsoft SQL Server database running on Amazon EC2 instance with Windows Server 2016. The solution must be able to be integrated in to the corporate Active Directory domain, be highly durable, be managed by AWS, and provided levels of throughput and IOPS. Which solution meets these requirements?


A) Use Amazon FSx for Windows File Server
B) Use Amazon Elastic File System (Amazon EFS)
C) Use AWS Storage Gateway in file gateway mode.
D) Deploy a Windows file server on two On Demand instances across two Availability Zones.

E) All of the above
F) None of the above

Correct Answer

verifed

verified

A company is designing a new web service that will run on Amazon EC2 instances behind an Elastic Load Balancer. However, many of the web service clients can only reach IP addresses whitelisted on their firewalls. What should a solutions architect recommend to meet the clients' needs?


A) A Network Load Balancer with an associated Elastic IP address.
B) An Application Load Balancer with an associated Elastic IP address
C) An A record in an Amazon Route 53 hosted zone pointing to an Elastic IP address
D) An EC2 instance with a public IP address running as a proxy in front of the load balancer

E) A) and B)
F) A) and C)

Correct Answer

verifed

verified

A company has a popular gaming platform running on AWS. The application is sensitive to latency because latency can impact the user experience and introduce unfair advantages to some players. The application is deployed in every AWS Region it runs on Amazon EC2 instances that are part of Auto Scaling groups configured behind Application Load Balancers (ALBs) . A solutions architect needs to implement a mechanism to monitor the health of the application and redirect traffic to healthy endpoints. Which solution meets these requirements?


A) Configure an accelerator in AWS Global Accelerator. Add a listener for the port that the application listens on and attach it to a Regional endpoint in each Region. Add the ALB as the endpoint.
B) Create an Amazon CloudFront distribution and specify the ALB as the origin server. Configure the cache behavior to use origin cache headers. Use AWS Lambda functions to optimize the traffic.
C) Create an Amazon CloudFront distribution and specify Amazon S3 as the origin server. Configure the cache behavior to use origin cache headers. Use AWS Lambda functions to optimize the traffic.
D) Configure an Amazon DynamoDB database to serve as the data store for the application. Create a DynamoDB Accelerator (DAX) cluster to act as the in-memory cache for DynamoDB hosting the application data.

E) All of the above
F) None of the above

Correct Answer

verifed

verified

A company has a web server running on an Amazon EC2 instance in a public subnet with an Elastic IP address. The default security group is assigned to the EC2 instance. The default network ACL has been modified to block all traffic. A solutions architect needs to make the web server accessible from everywhere on port 443. Which combination of steps will accomplish this task? (Choose two.)


A) Create a security group with a rule to allow TCP port 443 from source 0.0.0.0/0.
B) Create a security group with a rule to allow TCP port 443 to destination 0.0.0.0/0.
C) Update the network ACL to allow TCP port 443 from source 0.0.0.0/0.
D) Update the network ACL to allow inbound/outbound TCP port 443 from source 0.0.0.0/0 and to destination 0.0.0.0/0.
E) Update the network ACL to allow inbound TCP port 443 from source 0.0.0.0/0 and outbound TCP port 32768-65535 to destination 0.0.0.0/0.

F) A) and E)
G) C) and D)

Correct Answer

verifed

verified

A company has an application workflow that uses an AWS Lambda function to download and decrypt files from Amazon S3. These files are encrypted using AWS Key Management Service Customer Master Keys (AWS KMS CMKs) . A solutions architect needs to design a solution that will ensure the required permissions are set correctly. Which combination of actions accomplish this? (Choose two.)


A) Attach the kms:decrypt permission to the Lambda function's resource policy.
B) Grant the decrypt permission for the Lambda IAM role in the KMS key's policy.
C) Grant the decrypt permission for the Lambda resource policy in the KMS key's policy.
D) Create a new IAM policy with the kms:decrypt permission and attach the policy to the Lambda function.
E) Create a new IAM role with the kms:decrypt permission and attach the execution role to the Lambda function.

F) B) and E)
G) None of the above

Correct Answer

verifed

verified

An ecommerce company is experiencing an increase in user traffic. The company's store is deployed on Amazon EC2 instances as a two-tier two application consisting of a web tier and a separate database tier. As traffic increases, the company notices that the architecture is causing significant delays in sending timely marketing and order confirmation email to users. The company wants to reduce the time it spends resolving complex email delivery issues and minimize operational overhead. What should a solutions architect do to meet these requirements?


A) Create a separate application tier using EC2 instances dedicated to email processing.
B) Configure the web instance to send email through Amazon Simple Email Service (Amazon SES) .
C) Configure the web instance to send email through Amazon Simple Notification Service (Amazon SNS) .
D) Create a separate application tier using EC2 instances dedicated to email processing. Place the instances in an Auto Scaling group.

E) C) and D)
F) All of the above

Correct Answer

verifed

verified

A company has several business systems that require access to data stored in a file share. The business systems will access the file share using the Server Message Block (SMB) protocol. The file share solution should be accessible from both of the company's legacy on-premises environments and with AWS. Which services meet the business requirements? (Choose two.)


A) Amazon Elastic Block Store (Amazon EBS)
B) Amazon Elastic File System (Amazon EFS)
C) Amazon FSx for Windows
D) Amazon S3
E) AWS Storage Gateway file gateway

F) A) and B)
G) A) and C)

Correct Answer

verifed

verified

A security team to limit access to specific services or actions in all of the team's AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained. What should a solutions architect do to accomplish this?


A) Create an ACL to provide access to the services or actions.
B) Create a security group to allow accounts and attach it to user groups.
C) Create cross-account roles in each account to deny access to the services or actions.
D) Create a service control policy in the root organizational unit to deny access to the services or actions.

E) A) and B)
F) B) and D)

Correct Answer

verifed

verified

A company has an application running on Amazon EC2 instances in a private subnet. The application needs to store and retrieve data in Amazon S3. To reduce costs, the company wants to configure its AWS resources in a cost-effective manner. How should the company accomplish this?


A) Deploy a NAT gateway to access the S3 buckets.
B) Deploy AWS Storage Gateway to access the S3 buckets.
C) Deploy an S3 gateway endpoint to access the S3 buckets.
D) Deploy an S3 interface endpoint to access the S3 buckets.

E) B) and C)
F) A) and B)

Correct Answer

verifed

verified

A company is relocating its data center and wants to securely transfer 50 TB of data to AWS within 2 weeks. The existing data center has a Site-to-Site VPN connection to AWS that is 90% utilized. Which AWS service should a solutions architect use to meet these requirements?


A) AWS DataSync with a VPC endpoint
B) AWS Direct Connect
C) AWS Snowball Edge Storage Optimized
D) AWS Storage Gateway

E) All of the above
F) C) and D)

Correct Answer

verifed

verified

A company has a highly dynamic batch processing job that uses many Amazon EC2 instances to complete it. The job is stateless in nature, can be started and stopped at any given time with no negative impact, and typically takes upwards of 60 minutes total to complete. The company has asked a solutions architect to design a scalable and cost-effective solution that meets the requirements of the job. What should the solutions architect recommend?


A) Implement EC2 Spot Instances.
B) Purchase EC2 Reserved Instances.
C) Implement EC2 On-Demand Instances.
D) Implement the processing on AWS Lambda.

E) A) and D)
F) C) and D)

Correct Answer

verifed

verified

Showing 441 - 460 of 596

Related Exams

Show Answer