Question 1

Organizers for a global event want to put daily reports online as static HTML pages. The pages are expected to generate millions of views from users around the world. The files are stored in an Amazon S3 bucket. A solutions architect has been asked to design an efficient and effective solution. Which action should the solutions architect take to accomplish this?

Accepted Answer

A)  Generate presigned URLs for the files. 
B)  Use cross-Region replication to all Regions. 
C)  Use the geoproximity feature of Amazon Route 53. 
D)  Use Amazon CloudFront with the S3 bucket as its origin.

Question 2

A company is building a payment application that must be highly available even during regional service disruptions. A solutions architect must design a data storage solution that can be easily replicated and used in other AWS Regions. The application also requires low-latency atomicity, consistency, isolation, and durability (ACID) transactions that need to be immediately available to generate reports The development team also needs to use SQL. Which data storage solution meets these requirements?

Accepted Answer

A)  Amazon Aurora Global Database 
B)  Amazon DynamoDB global tables 
C)  Amazon S3 with cross-Region replication and Amazon Athena 
D)  MySQL on Amazon EC2 instances with Amazon Elastic Block Store (Amazon EBS) snapshot replication

Question 3

A solutions architect is developing a multiple-subnet VPC architecture. The solution will consist of six subnets in two Availability Zones. The subnets are defined as public, private and dedicated for databases. Only the Amazon EC2 instances running in the private subnets should be able to access a database. Which solution meets these requirements?

Accepted Answer

A)  Create a now route table that excludes the route to the public subnets' CIDR blocks. Associate the route table to the database subnets. 
B)  Create a security group that denies ingress from the security group used by instances in the public subnets. Attach the security group to an Amazon RDS DB instance. 
C)  Create a security group that allows ingress from the security group used by instances in the private subnets. Attach the security group to an Amazon RDS DB instance. 
D)  Create a new peering connection between the public subnets and the private subnets. Create a different peering connection between the private subnets and the database subnets.

Question 4

A solutions architect needs to ensure that all Amazon Elastic Block Store (Amazon EBS) volumes restored from unencrypted EBC snapshots are encrypted. What should the solutions architect do to accomplish this?

Accepted Answer

A)  Enable EBS encryption by default for the AWS Region. 
B)  Enable EBS encryption by default for the specific volumes. 
C)  Create a new volume and specify the symmetric customer master key (CMK) to use for encryption. 
D)  Create a new volume and specify the asymmetric customer master key (CMK) to use for encryption.

Question 5

An online photo-sharing company stores its photos in an Amazon S3 bucket that exists in the us-west-1 Region. The company needs to store a copy of all existing and new photos in another geographical location. Which solution will meet this requirement with the LEAST operational effort?

Accepted Answer

A)  Create a second S3 bucket in us-east-1. Enable S3 Cross-Region Replication from the existing S3 bucket to the second S3 bucket. 
B)  Create a cross-origin resource sharing (CORS) configuration of the existing S3 bucket. Specify us-east-1 in the CORS rule's AllowedOrigin element. 
C)  Create a second S3 bucket in us-east-1 across multiple Availability Zones. Create an S3 Lifecycle management rule to save photos into the second S3 bucket. 
D)  Create a second S3 bucket in us-east-1 to store the replicated photos. Configure S3 event notifications on object creation and update events that invoke an AWS Lambda function to copy photos from the existing S3 bucket to the second S3 bucket.

Question 6

A company has a customer relationship management (CRM) application that stores data in an Amazon RDS DB instance that runs Microsoft SQL Server. The company's IT staff has administrative access to the database. The database contains sensitive data. The company wants to ensure that the data is not accessible to the IT staff and that only authorized personnel can view the data. What should a solutions architect do to secure the data?

Accepted Answer

A)  Use client-side encryption with an Amazon RDS managed key. 
B)  Use client-side encryption with an AWS Key Management Service (AWS KMS) customer managed key. 
C)  Use Amazon RDS encryption with an AWS Key Management Service (AWS KMS) default encryption key. 
D)  Use Amazon RDS encryption with an AWS Key Management Service (AWS KMS) customer managed key.

Question 7

An Amazon EC2 administrator created the following policy associated with an IAM group containing several users:  What is the effect of this policy?

Accepted Answer

A)  Users can terminate an EC2 instance in any AWS Region except us-east-1. 
B)  Users can terminate an EC2 instance with the IP address 10.100.100.1 in the us-east-1 Region. 
C)  Users can terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100.100.254. 
D)  Users cannot terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100.100.254.

Question 8

A company hosts more than 300 global websites and applications. The company requires a platform to analyze more than 30 TB of clickstream data each day. What should a solutions architect do to transmit and process the clickstream data?

Accepted Answer

A)  Design an AWS Data Pipeline to archive the data to an Amazon S3 bucket and run an Amazon EMR cluster with the data to generate analytics. 
B)  Create an Auto Scaling group of Amazon EC2 instances to process the data and send it to an Amazon S3 data lake for Amazon Redshift to use for analysis. 
C)  Cache the data to Amazon CloudFront. Store the data in an Amazon S3 bucket. When an object is added to the S3 bucket, run an AWS Lambda function to process the data for analysis. 
D)  Collect the data from Amazon Kinesis Data Streams. Use Amazon Kinesis Data firehose to transmit the data to an Amazon S3 data lake. Load the data in Amazon Redshift for analysis.

Question 9

A solutions architect is creating an application that will handle batch processing of large amounts of data. The input data will be held in Amazon S3 and the output data will be stored in a different S3 bucket. For processing, the application will transfer the data over the network between multiple Amazon EC2 instances. What should the solutions architect do to reduce the overall data transfer costs?

Accepted Answer

A)  Place all the EC2 instances in an Auto Scaling group. 
B)  Place all the EC2 instances in the same AWS Region. 
C)  Place all the EC2 instances in the same Availability Zone. 
D)  Place all the EC2 instances in private subnets in multiple Availability Zones.

Question 10

A solutions architect has created a new AWS account and must secure AWS account root user access. Which combination of actions will accomplish this? (Choose two.)

Accepted Answer

A)  Ensure the root user uses a strong password. 
B)  Enable multi-factor authentication to the root user. 
C)  Store root user access keys in an encrypted Amazon S3 bucket. 
D)  Add the root user to a group containing administrative permissions. 
E)  Apply the required permissions to the root user with an inline policy document.

Question 11

A company runs a containerized application on a Kubernetes cluster in an on-premises data center. The company is using a MongoDB database for data storage. The company wants to migrate some of these environments to AWS, but no code changes or deployment method changes are possible at this time. The company needs a solution that minimizes operational overhead. Which solution meets these requirements?

Accepted Answer

A)  Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 worker nodes for compute and MongoDB on EC2 for data storage. 
B)  Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate for compute and Amazon DynamoDB for data storage. 
C)  Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes for compute and Amazon DynamoDB for data storage. 
D)  Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate for compute and Amazon DocumentDB (with MongoDB compatibility) for data storage.

Question 12

A company has several business systems that require access to data stored in a file share. The business systems will access the file share using the Server Message Block (SMB) protocol. The file share solution should be accessible from both of the company's legacy on-premises environments and with AWS. Which services meet the business requirements? (Choose two.)

Accepted Answer

A)  Amazon EBS 
B)  Amazon EFS 
C)  Amazon FSx for Windows 
D)  Amazon S3 
E)  AWS Storage Gateway file gateway

Question 13

A solutions architect wants all new users to have specific complexity requirements and mandatory rotation periods for IAM user passwords. What should the solutions architect do to accomplish this?

Accepted Answer

A)  Set an overall password policy for the entire AWS account 
B)  Set a password policy for each IAM user in the AWS account. 
C)  Use third-party vendor software to set password requirements. 
D)  Attach an Amazon CloudWatch rule to the Create_newuser event to set the password with the appropriate requirements.

Question 14

A recently created startup built a three-tier web application. The front end has static content. The application layer is based on microservices. User data is stored as JSON documents that need to be accessed with low latency. The company expects regular traffic to be low during the first year, with peaks in traffic when it publicizes new features every month. The startup team needs to minimize operational overhead costs. What should a solutions architect recommend to accomplish this?

Accepted Answer

A)  Use Amazon S3 static website hosting to store and serve the front end. Use AWS Elastic Beanstalk for the application layer. Use Amazon DynamoDB to store user data. 
B)  Use Amazon S3 static website hosting to store and serve the front end. Use Amazon Elastic KubernetesService (Amazon EKS) for the application layer. Use Amazon DynamoDB to store user data. 
C)  Use Amazon S3 static website hosting to store and serve the front end. Use Amazon API Gateway and AWS Lambda functions for the application layer. Use Amazon DynamoDB to store user data. 
D)  Use Amazon S3 static website hosting to store and serve the front end. Use Amazon API Gateway and AWS Lambda functions for the application layer. Use Amazon RDS with read replicas to store user data.

Question 15

A solutions architect is designing a system to analyze the performance of financial markets while the markets are closed. The system will run a series of compute-intensive jobs for 4 hours every night. The time to complete the compute jobs is expected to remain constant, and jobs cannot be interrupted once started. Once completed, the system is expected to run for a minimum of 1 year. Which type of Amazon EC2 instances should be used to reduce the cost of the system?

Accepted Answer

A)  Spot Instances 
B)  On-Demand Instances 
C)  Standard Reserved Instances 
D)  Scheduled Reserved Instances

Question 16

A company is planning to migrate a TCP-based application into the company's VPC. The application is publicly accessible on a nonstandard TCP port through a hardware appliance in the company's data center. This public endpoint can process up to 3 million requests per second with low latency. The company requires the same level of performance for the new public endpoint in AWS. What should a solutions architect recommend to meet this requirement?

Accepted Answer

A)  Deploy a Network Load Balancer (NL
B) . Configure the NLB to be publicly accessible over the TCP port that the application requires. 
B)  Deploy an Application Load Balancer (AL
B) . Configure the ALB to be publicly accessible over the TCP port that the application requires. 
C)  Deploy an Amazon CloudFront distribution that listens on the TCP port that the application requires. Use an Application Load Balancer as the origin. 
D)  Deploy an Amazon API Gateway API that is configured with the TCP port that the application requires. Configure AWS Lambda functions with provisioned concurrency to process the requests.

Question 17

A company is running a three-tier web application to process credit card payments. The front-end user interface consists of static webpages. The application tier can have long-running processes. The database tier uses MySQL. The application is currently running on a single, general purpose large Amazon EC2 instance. A solutions architect needs to decouple the services to make the web application highly available. Which solution would provide the HIGHEST availability?

Accepted Answer

A)  Move static assets to Amazon CloudFront. Leave the application in EC2 in an Auto Scaling group. Move the database to Amazon RDS to deploy Multi-AZ. 
B)  Move static assets and the application into a medium EC2 instance. Leave the database on the large instance. Place both instances in an Auto Scaling group. 
C)  Move static assets to Amazon S3. Move the application to AWS Lambda with the concurrency limit set. Move the database to Amazon DynamoDB with on-demand enabled. 
D)  Move static assets to Amazon S3. Move the application to Amazon Elastic Container Service (Amazon ECS) containers with Auto Scaling enabled. Move the database to Amazon RDS to deploy Multi-AZ.

Question 18

A company is seeing access requests by some suspicious IP addresses. The security team discovers the requests are from different IP addresses under the same CIDR range. What should a solutions architect recommend to the team?

Accepted Answer

A)  Add a rule in the inbound table of the security to deny the traffic from that CIDR range. 
B)  Add a rule in the outbound table of the security group to deny the traffic from that CIDR range. 
C)  Add a deny rule in the inbound table of the network ACL with a lower number than other rules. 
D)  Add a deny rule in the outbound table of the network ACL with a lower rule number than other rules.

Question 19

A solutions architect needs to design a network that will allow multiple Amazon EC2 instances to access a common data source used for mission-critical data that can be accessed by all the EC2 instances simultaneously. The solution must be highly scalable, easy to implement and support the NFS protocol. Which solution meets these requirements?

Accepted Answer

A)  Create an Amazon EFS file system. Configure a mount target in each Availability Zone. Attach each instance to the appropriate mount target. 
B)  Create an additional EC2 instance and configure it as a file server. Create a security group that allows communication between the Instances and apply that to the additional instance. 
C)  Create an Amazon S3 bucket with the appropriate permissions. Create a role in AWS IAM that grants the correct permissions to the S3 bucket. Attach the role to the EC2 Instances that need access to the data. 
D)  Create an Amazon EBS volume with the appropriate permissions. Create a role in AWS IAM that grants the correct permissions to the EBS volume. Attach the role to the EC2 instances that need access to the data.

Question 20

A group requires permissions to list an Amazon S3 bucket and delete objects from that bucket. An administrator has created the following IAM policy to provide access to the bucket and applied that policy to the group. The group is not able to delete objects in the bucket. The company follows least-privilege access rules.  Which statement should a solutions architect add to the policy to correct bucket access?

Accepted Answer

A)   
B)   
C)   
D)

Exam 9: AWS Certified Solutions Architect - Associate SAA-C02