Question 1

Your company has recently extended its datacenter into a VPC on AVVS to add burst computing capacity as needed Members of your Network Operations Center need to be able to go to the AWS Management Console and administer Amazon EC2 instances as necessary You don't want to create new IAM users for each NOC member and make those users sign in again to the AWS Management Console. Which option below will meet the needs for your NOC members?

Accepted Answer

A)  Use OAuth 2 0 to retrieve temporary AWS security credentials to enable your NOC members to sign in to the AWS Management Console. 
B)  Use web Identity Federation to retrieve AWS temporary security credentials to enable your NOC members to sign in to the AWS Management Console. 
C)  Use your on-premises SAML 2.0-compliant identity provider (IDP) to grant the NOC members federated access to the AWS Management Console via the AWS single sign-on (SSO) endpoint. 
D)  Use your on-premises SAML 2.0-compliam identity provider (IDP) to retrieve temporary security credentials to enable NOC members to sign in to the AWS Management Console.

Question 2

Which of the following components of AWS Data Pipeline specifies the business logic of your data management?

Accepted Answer

A)  Task Runner 
B)  Pipeline definition 
C)  AWS Direct Connect 
D)  Amazon Simple Storage Service 9Amazon S3)

Question 3

An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords. How can the organization achieve this?

Accepted Answer

A)  The organization should create each user in a separate region so that they have their own URL to login 
B)  The organization should create a separate login ID but give the IAM users the same alias so that each one can login with their alias 
C)  It is not possible to have the same login ID for multiple IAM users of the same account 
D)  The organization should create various groups and add each user with the same login ID to different groups. The user can login with their own group ID

Question 4

A company wants to launch an online shopping website in multiple countries and must ensure that customers are protected against potential "man-in-the-middle" attacks. Which architecture will provide the MOST secure site access?

Accepted Answer

A)  Use Amazon Route 53 for domain registration and DNS services. Enable DNSSEC for all Route 53 requests. Use AWS Certificate Manager (ACM) to register TLS/SSL certificates for the shopping website, and use Application Load Balancers configured with those TLS/SSL certificates for the site. Use the Server Name Identification extension in all client requests to the site. 
B)  Register 2048-bit encryption keys from a third-party certificate service. Use a third-party DNS provider that uses the customer managed keys for DNSSec. Upload the keys to ACM, and use ACM to automatically deploy the certificates for secure web services to an EC2 front-end web server fleet by using NGINX. Use the Server Name Identification extension in all client requests to the site. 
C)  Use Route 53 for domain registration. Register 2048-bit encryption keys from a third-party certificate service. Use a third-party DNS service that supports DNSSEC for DNS requests that use the customer managed keys. Import the customer managed keys to ACM to deploy the certificates to Classic Load Balancers configured with those TLS/SSL certificates for the site. Use the Server Name Identification extension in all clients requests to the site. 
D)  Use Route 53 for domain registration, and host the company DNS root servers on Amazon EC2 instances running Bind . Enable DNSSEC for DNS requests. Use ACM to register TLS/SSL certificates for the shopping website, and use Application Load Balancers configured with those TLS/SSL certificates for the site. Use the Server Name Identification extension in all client requests to the site. Use Route 53 for domain registration, and host the company DNS root servers on Amazon EC2 instances running Bind . Enable DNSSEC for DNS requests. Use ACM to register TLS/SSL certificates for the shopping website, and use Application Load Balancers configured with those TLS/SSL certificates for the site. Use the Server Name Identification extension in all client requests to the site.

Question 5

A company is building an AWS landing zone and has asked a Solutions Architect to design a multi-account access strategy that will allow hundreds of users to use corporate credentials to access the AWS Console. The company is running a Microsoft Active Directory, and users will use an AWS Direct Connect connection to connect to AWS. The company also wants to be able to federate to third-party services and providers, including custom applications. Which solution meets the requirements by using the LEAST amount of management overhead?

Accepted Answer

A)  Connect the Active Directory to AWS by using single sign-on and an Active Directory Federation Services (AD FS) with SAML 2.0, and then configure the Identity Provider (IdP) system to use form-based authentication. Build the AD FS portal page with corporate branding, and integrate third-party applications that support SAML 2.0 as required. 
B)  Create a two-way Forest trust relationship between the on-premises Active Directory and the AWS Directory Service. Set up AWS Single Sign-On with AWS Organizations. Use single sign-on integrations for connections with third-party applications. 
C)  Configure single sign-on by connecting the on-premises Active Directory using the AWS Directory Service AD Connector. Enable federation to the AWS services and accounts by using the IAM applications and services linking function. Leverage third-party single sign-on as needed. 
D)  Connect the company's Active Directory to AWS by using AD FS and SAML 2.0. Configure the AD FS claim rule to leverage Regex and a common Active Directory naming convention for the security group to allow federation of all AWS accounts. Leverage third-party single sign-on as needed, and add it to the AD FS server.

Question 6

A user has enabled detailed CloudWatch monitoring with the AWS Simple Notification Service. Which of the below mentioned statements helps the user understand detailed monitoring better?

Accepted Answer

A)  SNS cannot provide data every minute 
B)  SNS will send data every minute after configuration 
C)  There is no need to enable since SNS provides data every minute 
D)  AWS CloudWatch does not support monitoring for SNS

Question 7

You are running a news website in the eu-west-1 region that updates every 15 minutes. The website has a world-wide audience. It uses an Auto Scaling group behind an Elastic Load Balancer and an Amazon RDS database. Static content resides on Amazon S3, and is distributed through Amazon CloudFront. Your Auto Scaling group is set to trigger a scale up event at 60% CPU utilization. You use an Amazon RDS extra large DB instance with 10.000 Provisioned IOPS, its CPU utilization is around 80%, while freeable memory is in the 2 GB range. Web analytics reports show that the average load time of your web pages is around 1.5 to 2 seconds, but your SEO consultant wants to bring down the average load time to under 0.5 seconds. How would you improve page load times for your users? (Choose 3 answers)

Accepted Answer

A)  Lower the scale up trigger of your Auto Scaling group to 30% so it scales more aggressively. 
B)  Add an Amazon ElastiCache caching layer to your application for storing sessions and frequent DB queries 
C)  Configure Amazon CloudFront dynamic content support to enable caching of re-usable content from your site 
D)  Switch the Amazon RDS database to the high memory extra large Instance type 
E)  Set up a second installation in another region, and use the Amazon Route 53 latency-based routing feature to select the right region.

Question 8

A user has launched a dedicated EBS backed instance with EC2. You are curious where the EBS volume for this instance will be created. Which statement is correct about the EBS volume's creation?

Accepted Answer

A)  The EBS volume will not be created on the same tenant hardware assigned to the dedicated instance 
B)  AWS does not allow a dedicated EBS backed instance launch 
C)  The EBS volume will be created on the same tenant hardware assigned to the dedicated instance 
D)  The user can specify where the EBS will be created

Question 9

A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs, not on the Internet. What is the MOST operationally efficient way to enforce this requirement?

Accepted Answer

A)  Set the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC. 
B)  Create an SCP at the root level in the organization to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC. 
C)  Use AWS CloudFormation StackSets to create a new IAM policy in each AWS account that allows the s3:CreateAccessPoint action only if the s3:AccessPointNetworkOrigin condition key evaluates to VPC. 
D)  Set the S3 bucket policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.

Question 10

A user is configuring MySQL RDS with PIOPS. What should be the minimum PIOPS that the user should provision?

Accepted Answer

A)  1000 
B)  200 
C)  2000 
D)  500

Question 11

A user is running a batch process on EBS backed EC2 instances. The batch process launches few EC2 instances to process Hadoop Map reduce jobs which can run between 50 ?600 minutes or sometimes for even more time. The user wants a configuration that can terminate the instance only when the process is completed. How can the user configure this with CloudWatch?

Accepted Answer

A)  Configure a job which terminates all instances after 600 minutes 
B)  It is not possible to terminate instances automatically 
C)  Configure the CloudWatch action to terminate the instance when the CPU utilization falls below 5% 
D)  Set up the CloudWatch with Auto Scaling to terminate all the instances

Question 12

A company has several Amazon EC2 instances to both public and private subnets within a VPC that is not connected to the corporate network. A security group associated with the EC2 instances allows the company to use the Windows remote desktop protocol (RDP) over the internet to access the instances. The security team has noticed connection attempts from unknown sources. The company wants to implement a more secure solution to access the EC2 instances. Which strategy should a solutions architect implement?

Accepted Answer

A)  Deploy a Linux bastion host on the corporate network that has access to all instances in the VPC. 
B)  Deploy AWS Systems Manager Agent on the EC2 instances. Access the EC2 instances using Session Manager restricting access to users with permission. 
C)  Deploy a Linux bastion host with an Elastic IP address in the public subnet. Allow access to the bastion host from 0.0.0.0/0. 
D)  Establish a Site-to-Site VPN connecting the corporate network to the VPC. Update the security groups to allow access from the corporate network only.

Question 13

In Amazon Elastic Compute Cloud, you can specify storage volumes in addition to the root device volume when you create an AMI or when launching a new instance using______.

Accepted Answer

A)  block device mapping 
B)  object mapping 
C)  batch storage mapping 
D)  datacenter mapping

Question 14

An AWS partner company is building a service in AWS Organizations using its organization named org1. This service requires the partner company to have access to AWS resources in a customer account, which is in a separate organization named org2. The company must establish least privilege security access using an API or command line tool to the customer account. What is the MOST secure way to allow org1 to access resources in org2?

Accepted Answer

A)  The customer should provide the partner company with their AWS account access keys to log in and perform the required tasks. 
B)  The customer should create an IAM user and assign the required permissions to the IAM user. The customer should then provide the credentials to the partner company to log in and perform the required tasks. 
C)  The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role's Amazon Resource Name (ARN) when requesting access to perform the required tasks. 
D)  The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role's Amazon Resource Name (ARN), including the external ID in the IAM role's trust policy, when requesting access to perform the required tasks.

Question 15

A company is building a voting system for a popular TV show, viewers win watch the performances then visit the show's website to vote for their favorite performer.  It is expected that in a short period of time after the show has finished the site will receive millions of visitors. The visitors will first login to the site using their Amazon.com credentials and then submit their vote.  After the voting is completed the page will display the vote totals.  The company needs to build the site such that can handle the rapid influx of traffic while maintaining good performance but also wants to keep costs to a minimum. Which of the design patterns below should they use?

Accepted Answer

A)  Use CloudFront and an Elastic Load balancer in front of an auto-scaled set of web servers, the web servers will first call the Login With Amazon service to authenticate the user then process the users vote and store the result into a multi-AZ Relational Database Service instance. 
B)  Use CloudFront and the static website hosting feature of S3 with the Javascript SDK to call the Login With Amazon service to authenticate the user, use IAM Roles to gain permissions to a DynamoDB table to store the users vote. 
C)  Use CloudFront and an Elastic Load Balancer in front of an auto-scaled set of web servers, the web servers will first call the Login with Amazon service to authenticate the user, the web servers will process the users vote and store the result into a DynamoDB table using IAM Roles for EC2 instances to gain permissions to the DynamoDB table. 
D)  Use CloudFront and an Elastic Load Balancer in front of an auto-scaled set of web servers, the web servers will first call the Login With Amazon service to authenticate the user, the web servers win process the users vote and store the result into an SQS queue using IAM Roles for EC2 Instances to gain permissions to the SQS queue. A set of application servers will then retrieve the items from the queue and store the result into a DynamoDB table.

Question 16

An enterprise company is using a multi-account AWS strategy. There are separate accounts for development staging and production workloads. To control costs and improve governance the following requirements have been defined: The company must be able to calculate the AWS costs for each project. The company must be able to calculate the AWS costs for each environment development staging and production. Commonly deployed IT services must be centrally managed. Business units can deploy pre-approved IT services only. Usage of AWS resources in the development account must be limited. Which combination of actions should be taken to meet these requirements? (Choose three.)

Accepted Answer

A)  Apply environment, cost center, and application name tags to all taggable resources. 
B)  Configure custom budgets and define thresholds using Cost Explorer. 
C)  Configure AWS Trusted Advisor to obtain weekly emails with cost-saving estimates. 
D)  Create a portfolio for each business unit and add products to the portfolios using AWS CloudFormation in AWS Service Catalog. 
E)  Configure a billing alarm in Amazon CloudWatch.
F) Configure SCPs in AWS Organizations to allow services available using AWS.

Question 17

A company maintains a restaurant review website. The website is a single-page application where files are stored in Amazon S3 and delivered using Amazon CloudFront. The company receives several fake postings every day that are manually removed. The security team has identified that most of the fake posts are from bots with IP addresses that have a bad reputation within the same global region. The team needs to create a solution to help restrict the bots from accessing the website. Which strategy should a solutions architect use?

Accepted Answer

A)  Use AWS Firewall Manage to control the CloudFront distribution security settings. Create a geographical block rule and associate it with Firewall Manager. 
B)  Associate an AWS WAF web ACL with the CloudFront distribution. Select the managed Amazon IP reputation rule group for the web ACL with a deny action. 
C)  Use AWS Firewall Manager to control the CloudFront distribution security settings. Select the managed Amazon IP reputation rule group and associate it with Firewall Manager with a deny action. 
D)  Associate an AWS WAF web ACL with the CloudFront distribution. Create a rule group for the web ACL with a geographical match statement with a deny action.

Question 18

Your startup wants to implement an order fulfillment process for selling a personalized gadget that needs an average of 3-4 days to produce with some orders taking up to 6 months you expect 10 orders per day on your first day. 1000 orders per day after 6 months and 10,000 orders after 12 months. Orders coming in are checked for consistency men dispatched to your manufacturing plant for production quality control packaging shipment and payment processing If the product does not meet the quality standards at any stage of the process employees may force the process to repeat a step Customers are notified via email about order status and any critical issues with their orders such as payment failure. Your base architecture includes AWS Elastic Beanstalk for your website with an RDS MySQL instance for customer data and orders. How can you implement the order fulfillment process while making sure that the emails are delivered reliably?

Accepted Answer

A)  Add a business process management application to your Elastic Beanstalk app servers and re-use the ROS database for tracking order status use one of the Elastic Beanstalk instances to send emails to customers. 
B)  Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 Use the decider instance to send emails to customers. 
C)  Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 use SES to send emails to customers. 
D)  Use an SQS queue to manage all process tasks Use an Auto Scaling group of EC2 Instances that poll the tasks and execute them. Use SES to send emails to customers.

Question 19

In Amazon ElastiCache replication groups of Redis, for performance tuning reasons, you can change the roles of the cache nodes within the replication group, with the primary and one of the replicas exchanging roles.

Accepted Answer

A)  True, however, you get lower performance. 
B)  false 
C)  true 
D)  False, you must recreate the replication group to improve performance tuning.

Question 20

Which of the following are characteristics of Amazon VPC subnets? (Choose two.)

Accepted Answer

A)  Each subnet spans at least 2 Availability Zones to provide a high-availability environment. 
B)  Each subnet maps to a single Availability Zone. 
C)  CIDR block mask of /25 is the smallest range supported. 
D)  By default, all subnets can route between each other, whether they are private or public. 
E)  Instances in a private subnet can communicate with the Internet only if they have an Elastic IP.

Exam 10: AWS Certified Solutions Architect - Professional (SAP-C01)