SAP-C02 — questions

Page 10 of 27 · 529 total questions.

SAP-C02 Question 181

Topic 1 · Question 181

A company is designing its network configuration in the AWS Cloud. The company uses AWS Organizations to manage a multi-account setup. The company has three OUs. Each OU contains more than 100 AWS accounts. Each account has a single VPC, and all the VPCs in each OU are in the same AWS Region. The CIDR ranges for all the AWS accounts do not overlap. The company needs to implement a solution in which VPCs in the same OU can communicate with each other but cannot communicate with VPCs in other OUs. Which solution will meet these requirements with the LEAST operational overhead?

ACreate an AWS CloudFormation stack set that establishes VPC peering between accounts in each OU. Provision the stack set in each OU.
BIn each OU, create a dedicated networking account that has a single VPC. Share this VPC with all the other accounts in the OU by using AWS Resource Access Manager (AWS RAM). Create a VPC peering connection between the networking account and each account in the OU.
CProvision a transit gateway in an account in each OU. Share the transit gateway across the organization by using AWS Resource Access Manager (AWS RAM). Create transit gateway VPC attachments for each VPC. (correct answer)
DIn each OU, create a dedicated networking account that has a single VPC. Establish a VPN connection between the networking account and the other accounts in the OU. Use third-party routing software to route transitive traffic between the VPCs.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Provision a transit gateway in an account in each OU. Share the transit gateway across the organization by using AWS Resource Access Manager (AWS RAM). Create transit gateway VPC attachments for each VPC.

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale.

SAP-C02 Question 182

Single page →

Topic 1 · Question 182

A company is migrating an application to AWS. It wants to use fully managed services as much as possible during the migration. The company needs to store large important documents within the application with the following requirements: 1. The data must be highly durable and available 2. The data must always be encrypted at rest and in transit 3. The encryption key must be managed by the company and rotated periodically Which of the following solutions should the solutions architect recommend?

ADeploy the storage gateway to AWS in file gateway mode. Use Amazon EBS volume encryption using an AWS KMS key to encrypt the storage gateway volumes.
BUse Amazon S3 with a bucket policy to enforce HTTPS for connections to the bucket and to enforce server-side encryption and AWS KMS for object encryption. (correct answer)
CUse Amazon DynamoDB with SSL to connect to DynamoDB. Use an AWS KMS key to encrypt DynamoDB objects at rest.
DDeploy instances with Amazon EBS volumes attached to store this data. Use EBS volume encryption using an AWS KMS key to encrypt the data.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Use Amazon S3 with a bucket policy to enforce HTTPS for connections to the bucket and to enforce server-side encryption and AWS KMS for object encryption.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SAP-C02 Question 183

Single page →

Topic 1 · Question 183

A company’s public API runs as tasks on Amazon Elastic Container Service (Amazon ECS). The tasks run on AWS Fargate behind an Application Load Balancer (ALB) and are configured with Service Auto Scaling for the tasks based on CPU utilization. This service has been running well for several months. Recently, API performance slowed down and made the application unusable. The company discovered that a significant number of SQL injection attacks had occurred against the API and that the API service had scaled to its maximum amount. A solutions architect needs to implement a solution that prevents SQL injection attacks from reaching the ECS API service. The solution must allow legitimate traffic through and must maximize operational efficiency. Which solution meets these requirements?

ACreate a new AWS WAF web ACL to monitor the HTTP requests and HTTPS requests that are forwarded to the ALB in front of the ECS tasks.
BCreate a new AWS WAF Bot Control implementation. Add a rule in the AWS WAF Bot Control managed rule group to monitor traffic and allow only legitimate traffic to the ALB in front of the ECS tasks.
CCreate a new AWS WAF web ACL. Add a new rule that blocks requests that match the SQL database rule group. Set the web ACL to allow all other traffic that does not match those rules. Attach the web ACL to the ALB in front of the ECS tasks. (correct answer)
DCreate a new AWS WAF web ACL. Create a new empty IP set in AWS WAF. Add a new rule to the web ACL to block requests that originate from IP addresses in the new IP set. Create an AWS Lambda function that scrapes the API logs for IP addresses that send SQL injection attacks, and add those IP addresses to the IP set. Attach the web ACL to the ALB in front of the ECS tasks.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create a new AWS WAF web ACL. Add a new rule that blocks requests that match the SQL database rule group. Set the web ACL to allow all other traffic that does not match those rules. Attach the web ACL to the ALB in fr...

Explanation

Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. AWS WAF protects web applications from common exploits and malicious requests.

SAP-C02 Question 184

Single page →

Topic 1 · Question 184

An environmental company is deploying sensors in major cities throughout a country to measure air quality. The sensors connect to AWS IoT Core to ingest timeseries data readings. The company stores the data in Amazon DynamoDB. For business continuity, the company must have the ability to ingest and store data in two AWS Regions. Which solution will meet these requirements?

ACreate an Amazon Route 53 alias failover routing policy with values for AWS IoT Core data endpoints in both Regions Migrate data to Amazon Aurora global tables.
BCreate a domain configuration for AWS IoT Core in each Region. Create an Amazon Route 53 latency-based routing policy. Use AWS IoT Core data endpoints in both Regions as values. Migrate the data to Amazon MemoryDB for Redis and configure cross-Region replication.
CCreate a domain configuration for AWS IoT Core in each Region. Create an Amazon Route 53 health check that evaluates domain configuration health. Create a failover routing policy with values for the domain name from the AWS IoT Core domain configurations. Update the DynamoDB table to a global table. (correct answer)
DCreate an Amazon Route 53 latency-based routing policy. Use AWS IoT Core data endpoints in both Regions as values. Configure DynamoDB streams and cross-Region data replication.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create a domain configuration for AWS IoT Core in each Region. Create an Amazon Route 53 health check that evaluates domain configuration health. Create a failover routing policy with values for the domain name from t...

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 185

Single page →

Topic 1 · Question 185

A company uses AWS Organizations for a multi-account setup in the AWS Cloud. The company's finance team has a data processing application that uses AWS Lambda and Amazon DynamoDB. The company's marketing team wants to access the data that is stored in the DynamoDB table. The DynamoDB table contains confidential data. The marketing team can have access to only specific attributes of data in the DynamoDB table. The finance team and the marketing team have separate AWS accounts. What should a solutions architect do to provide the marketing team with the appropriate access to the DynamoDB table?

ACreate an SCP to grant the marketing team's AWS account access to the specific attributes of the DynamoDB table. Attach the SCP to the OU of the finance team.
BCreate an IAM role in the finance team's account by using IAM policy conditions for specific DynamoDB attributes (fine-grained access control). Establish trust with the marketing team's account. In the marketing team's account, create an IAM role that has permissions to assume the IAM role in the finance team's account. (correct answer)
CCreate a resource-based IAM policy that includes conditions for specific DynamoDB attributes (fine-grained access control). Attach the policy to the DynamoDB table. In the marketing team's account, create an IAM role that has permissions to access the DynamoDB table in the finance team's account.
DCreate an IAM role in the finance team's account to access the DynamoDB table. Use an IAM permissions boundary to limit the access to the specific attributes. In the marketing team's account, create an IAM role that has permissions to assume the IAM role in the finance team's account.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create an IAM role in the finance team's account by using IAM policy conditions for specific DynamoDB attributes (fine-grained access control). Establish trust with the marketing team's account. In the marketing team'...

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SAP-C02 Question 186

Single page →

Topic 1 · Question 186 · Select all that apply

A solutions architect is creating an application that stores objects in an Amazon S3 bucket. The solutions architect must deploy the application in two AWS Regions that will be used simultaneously. The objects in the two S3 buckets must remain synchronized with each other. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

ACreate an S3 Multi-Region Access Point Change the application to refer to the Multi-Region Access Point (correct answer)
BConfigure two-way S3 Cross-Region Replication (CRR) between the two S3 buckets (correct answer)
CModify the application to store objects in each S3 bucket
DCreate an S3 Lifecycle rule for each S3 bucket to copy objects from one S3 bucket to the other S3 bucket
EEnable S3 Versioning for each S3 bucket (correct answer)
FConfigure an event notification for each S3 bucket to invoke an AWS Lambda function to copy objects from one S3 bucket to the other S3 bucket

Reveal answer & explanation

Correct answer: A, B, E

The correct answer is A, B, E. Option A: Create an S3 Multi-Region Access Point Change the application to refer to the Multi-Region Access Point Option B: Configure two-way S3 Cross-Region Replication (CRR) between the two S3 buckets Option E: Enable S3 Versioning for each S3 bucket

Explanation

S3 Cross-Region Replication asynchronously copies objects to another Region for compliance or latency. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 187

Single page →

Topic 1 · Question 187 · Select all that apply

A company has an IoT platform that runs in an on-premises environment. The platform consists of a server that connects to IoT devices by using the MQTT protocol. The platform collects telemetry data from the devices at least once every 5 minutes. The platform also stores device metadata in a MongoDB cluster. An application that is installed on an on-premises machine runs periodic jobs to aggregate and transform the telemetry and device metadata. The application creates reports that users view by using another web application that runs on the same on-premises machine. The periodic jobs take 120-600 seconds to run. However, the web application is always running. The company is moving the platform to AWS and must reduce the operational overhead of the stack. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

AUse AWS Lambda functions to connect to the IoT devices
BConfigure the IoT devices to publish to AWS IoT Core (correct answer)
CWrite the metadata to a self-managed MongoDB database on an Amazon EC2 instance
DWrite the metadata to Amazon DocumentDB (with MongoDB compatibility) (correct answer)
EUse AWS Step Functions state machines with AWS Lambda tasks to prepare the reports and to write the reports to Amazon S3. Use Amazon CloudFront with an S3 origin to serve the reports (correct answer)
FUse an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 instances to prepare the reports. Use an ingress controller in the EKS cluster to serve the reports

Reveal answer & explanation

Correct answer: B, D, E

The correct answer is B, D, E. Option B: Configure the IoT devices to publish to AWS IoT Core Option D: Write the metadata to Amazon DocumentDB (with MongoDB compatibility) Option E: Use AWS Step Functions state machines with AWS Lambda tasks to prepare the reports and to write the reports to Amazon S3. Use Amazon CloudFront with an S3 origin to serve the reports

Explanation

SAP-C02 Question 188

Single page →

Topic 1 · Question 188

A global manufacturing company plans to migrate the majority of its applications to AWS. However, the company is concerned about applications that need to remain within a specific country or in the company's central on-premises data center because of data regulatory requirements or requirements for latency of single-digit milliseconds. The company also is concerned about the applications that it hosts in some of its factory sites, where limited network infrastructure exists. The company wants a consistent developer experience so that its developers can build applications once and deploy on premises, in the cloud, or in a hybrid architecture. The developers must be able to use the same tools, APIs, and services that are familiar to them. Which solution will provide a consistent hybrid experience to meet these requirements?

AMigrate all applications to the closest AWS Region that is compliant. Set up an AWS Direct Connect connection between the central on-premises data center and AWS. Deploy a Direct Connect gateway.
BUse AWS Snowball Edge Storage Optimized devices for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Retain the devices on premises. Deploy AWS Wavelength to host the workloads in the factory sites.
CInstall AWS Outposts for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Use AWS Snowball Edge Compute Optimized devices to host the workloads in the factory sites. (correct answer)
DMigrate the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds to an AWS Local Zone. Deploy AWS Wavelength to host the workloads in the factory sites.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Install AWS Outposts for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Use AWS Snowball Edge Compute Optimized devices to host the workloads in the f...

Explanation

AWS Outposts extends AWS infrastructure on premises for low-latency or data-residency needs. AWS Snowball physically ships data to AWS, ideal when bandwidth is limited or data is very large. This option meets the real-time / low-latency performance requirement.

SAP-C02 Question 189

Single page →

Topic 1 · Question 189 · Select all that apply

A company is updating an application that customers use to make online orders. The number of attacks on the application by bad actors has increased recently. The company will host the updated application on an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use Amazon DynamoDB to store application data. A public Application Load Balancer (ALB) will provide end users with access to the application. The company must prevent attacks and ensure business continuity with minimal service interruptions during an ongoing attack. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

ACreate an Amazon CloudFront distribution with the ALB as the origin. Add a custom header and random value on the CloudFront domain. Configure the ALB to conditionally forward traffic if the header and value match. (correct answer)
BDeploy the application in two AWS Regions. Configure Amazon Route 53 to route to both Regions with equal weight.
CConfigure auto scaling for Amazon ECS tasks Create a DynamoDB Accelerator (DAX) cluster.
DConfigure Amazon ElastiCache to reduce overhead on DynamoDB.
EDeploy an AWS WAF web ACL that includes an appropriate rule group. Associate the web ACL with the Amazon CloudFront distribution. (correct answer)

Reveal answer & explanation

Correct answer: A, E

The correct answer is A, E. Option A: Create an Amazon CloudFront distribution with the ALB as the origin. Add a custom header and random value on the CloudFront domain. Configure the ALB to conditionally forward traffic if the header and value match. Option E: Deploy an AWS WAF web ACL that includes an appropriate rule group. Associate the web ACL with the Amazon CloudFront distribution.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS WAF protects web applications from common exploits and malicious requests. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SAP-C02 Question 190

Single page →

Topic 1 · Question 190

A company runs a web application on AWS. The web application delivers static content from an Amazon S3 bucket that is behind an Amazon CloudFront distribution. The application serves dynamic content by using an Application Load Balancer (ALB) that distributes requests to a fleet of Amazon EC2 instances in Auto Scaling groups. The application uses a domain name setup in Amazon Route 53. Some users reported occasional issues when the users attempted to access the website during peak hours. An operations team found that the ALB sometimes returned HTTP 503 Service Unavailable errors. The company wants to display a custom error message page when these errors occur. The page should be displayed immediately for this error code. Which solution will meet these requirements with the LEAST operational overhead?

ASet up a Route 53 failover routing policy. Configure a health check to determine the status of the ALB endpoint and to fail over to the failover S3 bucket endpoint.
BCreate a second CloudFront distribution and an S3 static website to host the custom error page. Set up a Route 53 failover routing policy. Use an active-passive configuration between the two distributions.
CCreate a CloudFront origin group that has two origins. Set the ALB endpoint as the primary origin. For the secondary origin, set an S3 bucket that is configured to host a static website Set up origin failover for the CloudFront distribution. Update the S3 static website to incorporate the custom error page. (correct answer)
DCreate a CloudFront function that validates each HTTP response code that the ALB returns. Create an S3 static website in an S3 bucket. Upload the custom error page to the S3 bucket as a failover. Update the function to read the S3 bucket and to serve the error page to the end users.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create a CloudFront origin group that has two origins. Set the ALB endpoint as the primary origin. For the secondary origin, set an S3 bucket that is configured to host a static website Set up origin failover for the...

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon EBS provides block storage attached to a single EC2 instance. Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SAP-C02 Question 191

Single page →

Topic 1 · Question 191

A company is planning to migrate an application to AWS. The application runs as a Docker container and uses an NFS version 4 file share. A solutions architect must design a secure and scalable containerized solution that does not require provisioning or management of the underlying infrastructure. Which solution will meet these requirements?

ADeploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type. Use Amazon Elastic File System (Amazon EFS) for shared storage. Reference the EFS file system ID, container mount point, and EFS authorization IAM role in the ECS task definition. (correct answer)
BDeploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type. Use Amazon FSx for Lustre for shared storage. Reference the FSx for Lustre file system ID, container mount point, and FSx for Lustre authorization IAM role in the ECS task definition.
CDeploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type and auto scaling turned on. Use Amazon Elastic File System (Amazon EFS) for shared storage. Mount the EFS file system on the ECS container instances. Add the EFS authorization IAM role to the EC2 instance profile.
DDeploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type and auto scaling turned on. Use Amazon Elastic Block Store (Amazon EBS) volumes with Multi-Attach enabled for shared storage. Attach the EBS volumes to ECS container instances. Add the EBS authorization IAM role to an EC2 instance profile.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Deploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type. Use Amazon Elastic File System (Amazon EFS) for shared storage. Reference the EFS file system ID,...

Explanation

AWS Fargate runs containers serverlessly so there are no EC2 hosts to manage or patch. Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. Amazon EFS is a shared, elastic NFS file system that multiple instances can mount concurrently across AZs.

SAP-C02 Question 192

Single page →

Topic 1 · Question 192

A company is running an application in the AWS Cloud. The core business logic is running on a set of Amazon EC2 instances in an Auto Scaling group. An Application Load Balancer (ALB) distributes traffic to the EC2 instances. Amazon Route 53 record api.example.com is pointing to the ALB. The company's development team makes major updates to the business logic. The company has a rule that when changes are deployed, only 10% of customers can receive the new logic during a testing window. A customer must use the same version of the business logic during the testing window. How should the company deploy the updates to meet these requirements?

ACreate a second ALB, and deploy the new logic to a set of EC2 instances in a new Auto Scaling group. Configure the ALB to distribute traffic to the EC2 instances. Update the Route 53 record to use weighted routing, and point the record to both of the ALBs.
BCreate a second target group that is referenced by the ALDeploy the new logic to EC2 instances in this new target group. Update the ALB listener rule to use weighted target groups. Configure ALB target group stickiness. (correct answer)
CCreate a new launch configuration for the Auto Scaling group. Specify the launch configuration to use the AutoScalingRollingUpdate policy, and set the MaxBatchSize option to 10. Replace the launch configuration on the Auto Scaling group. Deploy the changes.
DCreate a second Auto Scaling group that is referenced by the ALB. Deploy the new logic on a set of EC2 instances in this new Auto Scaling group. Change the ALB routing algorithm to least outstanding requests (LOR). Configure ALB session stickiness.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create a second target group that is referenced by the ALDeploy the new logic to EC2 instances in this new target group. Update the ALB listener rule to use weighted target groups. Configure ALB target group stickiness.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 193

Single page →

Topic 1 · Question 193

A large education company recently introduced Amazon Workspaces to provide access to internal applications across multiple universities. The company is storing user profiles on an Amazon FSx for Windows File Server file system. The file system is configured with a DNS alias and is connected to a self-managed Active Directory. As more users begin to use the Workspaces, login time increases to unacceptable levels. An investigation reveals a degradation in performance of the file system. The company created the file system on HDD storage with a throughput of 16 MBps. A solutions architect must improve the performance of the file system during a defined maintenance window. What should the solutions architect do to meet these requirements with the LEAST administrative effort?

AUse AWS Backup to create a point-in-time backup of the file system. Restore the backup to a new FSx for Windows File Server file system. Select SSD as the storage type. Select 32 MBps as the throughput capacity. When the backup and restore process is completed, adjust the DNS alias accordingly. Delete the original file system.
BDisconnect users from the file system. In the Amazon FSx console, update the throughput capacity to 32 MBps. Update the storage type to SSD. Reconnect users to the file system. (correct answer)
CDeploy an AWS DataSync agent onto a new Amazon EC2 instance. Create a task. Configure the existing file system as the source location. Configure a new FSx for Windows File Server file system with SSD storage and 32 MBps of throughput as the target location. Schedule the task. When the task is completed, adjust the DNS alias accordingly. Delete the original file system.
DEnable shadow copies on the existing file system by using a Windows PowerShell command. Schedule the shadow copy job to create a point-in-time backup of the file system. Choose to restore previous versions. Create a new FSx for Windows File Server file system with SSD storage and 32 MBps of throughput. When the copy job is completed, adjust the DNS alias. Delete the original file system.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Disconnect users from the file system. In the Amazon FSx console, update the throughput capacity to 32 MBps. Update the storage type to SSD. Reconnect users to the file system.

Explanation

Amazon FSx provides fully managed third-party file systems.

SAP-C02 Question 194

Single page →

Topic 1 · Question 194

A company hosts an application on AWS. The application reads and writes objects that are stored in a single Amazon S3 bucket. The company must modify the application to deploy the application in two AWS Regions. Which solution will meet these requirements with the LEAST operational overhead?

ASet up an Amazon CloudFront distribution with the S3 bucket as an origin. Deploy the application to a second Region Modify the application to use the CloudFront distribution. Use AWS Global Accelerator to access the data in the S3 bucket.
BCreate a new S3 bucket in a second Region. Set up bidirectional S3 Cross-Region Replication (CRR) between the original S3 bucket and the new S3 bucket. Configure an S3 Multi-Region Access Point that uses both S3 buckets. Deploy a modified application to both Regions. (correct answer)
CCreate a new S3 bucket in a second Region Deploy the application in the second Region. Configure the application to use the new S3 bucket. Set up S3 Cross-Region Replication (CRR) from the original S3 bucket to the new S3 bucket.
DSet up an S3 gateway endpoint with the S3 bucket as an origin. Deploy the application to a second Region. Modify the application to use the new S3 gateway endpoint. Use S3 Intelligent-Tiering on the S3 bucket.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create a new S3 bucket in a second Region. Set up bidirectional S3 Cross-Region Replication (CRR) between the original S3 bucket and the new S3 bucket. Configure an S3 Multi-Region Access Point that uses both S3 bucke...

Explanation

SAP-C02 Question 195

Single page →

Topic 1 · Question 195

An online gaming company needs to rehost its gaming platform on AWS. The company's gaming application requires high performance computing (HPC) processing and has a leaderboard that changes frequently. An Ubuntu instance that is optimized for compute generation hosts a Node.js application for game display. Game state is tracked in an on-premises Redis instance. The company needs a migration strategy that optimizes application performance. Which solution will meet these requirements?

ACreate an Auto Scaling group of m5.large Amazon EC2 Spot Instances behind an Application Load Balancer. Use an Amazon ElastlCache for Redis cluster to maintain the leaderboard.
BCreate an Auto Scaling group of c5.large Amazon EC2 Spot Instances behind an Application Load Balancer. Use an Amazon OpenSearch Service cluster to maintain the leaderboard.
CCreate an Auto Scaling group of c5.large Amazon EC2 On-Demand Instances behind an Application Load Balancer. Use an Amazon ElastiCache for Redis cluster to maintain the leaderboard. (correct answer)
DCreate an Auto Scaling group of m5.large Amazon EC2 On-Demand Instances behind an Application Load Balancer. Use an Amazon DynamoDB table to maintain the leaderboard.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create an Auto Scaling group of c5.large Amazon EC2 On-Demand Instances behind an Application Load Balancer. Use an Amazon ElastiCache for Redis cluster to maintain the leaderboard.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon ElastiCache provides in-memory caching (Redis/Memcached) to reduce latency and offload the database.

SAP-C02 Question 196

Single page →

Topic 1 · Question 196 · Select all that apply

A solutions architect is designing an application to accept timesheet entries from employees on their mobile devices. Timesheets will be submitted weekly, with most of the submissions occurring on Friday. The data must be stored in a format that allows payroll administrators to run monthly reports. The infrastructure must be highly available and scale to match the rate of incoming data and reporting requests. Which combination of steps meets these requirements while minimizing operational overhead? (Choose two.)

ADeploy the application to Amazon EC2 On-Demand Instances with load balancing across multiple Availability Zones. Use scheduled Amazon EC2 Auto Scaling to add capacity before the high volume of submissions on Fridays.
BDeploy the application in a container using Amazon Elastic Container Service (Amazon ECS) with load balancing across multiple Availability Zones. Use scheduled Service Auto Scaling to add capacity before the high volume of submissions on Fridays.
CDeploy the application front end to an Amazon S3 bucket served by Amazon CloudFront. Deploy the application backend using Amazon API Gateway with an AWS Lambda proxy integration. (correct answer)
DStore the timesheet submission data in Amazon Redshift. Use Amazon QuickSight to generate the reports using Amazon Redshift as the data source.
EStore the timesheet submission data in Amazon S3. Use Amazon Athena and Amazon QuickSight to generate the reports using Amazon S3 as the data source. (correct answer)

Reveal answer & explanation

Correct answer: C, E

The correct answer is C, E. Option C: Deploy the application front end to an Amazon S3 bucket served by Amazon CloudFront. Deploy the application backend using Amazon API Gateway with an AWS Lambda proxy integration. Option E: Store the timesheet submission data in Amazon S3. Use Amazon Athena and Amazon QuickSight to generate the reports using Amazon S3 as the data source.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAP-C02 Question 197

Single page →

Topic 1 · Question 197 · Select all that apply

A company is storing sensitive data in an Amazon S3 bucket. The company must log all activities for objects in the S3 bucket and must keep the logs for 5 years. The company's security team also must receive an email notification every time there is an attempt to delete data in the S3 bucket. Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)

AConfigure AWS CloudTrail to log S3 data events. (correct answer)
BConfigure S3 server access logging for the S3 bucket.
CConfigure Amazon S3 to send object deletion events to Amazon Simple Email Service (Amazon SES).
DConfigure Amazon S3 to send object deletion events to an Amazon EventBridge event bus that publishes to an Amazon Simple Notification Service (Amazon SNS) topic. (correct answer)
EConfigure Amazon S3 to send the logs to Amazon Timestream with data storage tiering.
FConfigure a new S3 bucket to store the logs with an S3 Lifecycle policy. (correct answer)

Reveal answer & explanation

Correct answer: A, D, F

The correct answer is A, D, F. Option A: Configure AWS CloudTrail to log S3 data events. Option D: Configure Amazon S3 to send object deletion events to an Amazon EventBridge event bus that publishes to an Amazon Simple Notification Service (Amazon SNS) topic. Option F: Configure a new S3 bucket to store the logs with an S3 Lifecycle policy.

Explanation

S3 Lifecycle policies automatically transition or expire objects to control storage cost. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. This option delivers the requirement at the lowest cost.

SAP-C02 Question 198

Single page →

Topic 1 · Question 198 · Select all that apply

A company is building a hybrid environment that includes servers in an on-premises data center and in the AWS Cloud. The company has deployed Amazon EC2 instances in three VPCs. Each VPC is in a different AWS Region. The company has established an AWS Direct. Connect connection to the data center from the Region that is closest to the data center. The company needs the servers in the on-premises data center to have access to the EC2 instances in all three VPCs. The servers in the on-premises data center also must have access to AWS public services. Which combination of steps will meet these requirements with the LEAST cost? (Choose two.)

ACreate a Direct Connect gateway in the Region that is closest to the data center. Attach the Direct Connect connection to the Direct Connect gateway. Use the Direct Connect gateway to connect the VPCs in the other two Regions. (correct answer)
BSet up additional Direct Connect connections from the on-premises data center to the other two Regions.
CCreate a private VIF. Establish an AWS Site-to-Site VPN connection over the private VIF to the VPCs in the other two Regions.
DCreate a public VIF. Establish an AWS Site-to-Site VPN connection over the public VIF to the VPCs in the other two Regions. (correct answer)
EUse VPC peering to establish a connection between the VPCs across the Regions Create a private VIF with the existing Direct Connect connection to connect to the peered VPCs.

Reveal answer & explanation

Correct answer: A, D

The correct answer is A, D. Option A: Create a Direct Connect gateway in the Region that is closest to the data center. Attach the Direct Connect connection to the Direct Connect gateway. Use the Direct Connect gateway to connect the VPCs in the other two... Option D: Create a public VIF. Establish an AWS Site-to-Site VPN connection over the public VIF to the VPCs in the other two Regions.

Explanation

AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS. AWS Site-to-Site VPN provides encrypted connectivity between on premises and a VPC. This option delivers the requirement at the lowest cost.

SAP-C02 Question 199

Single page →

Topic 1 · Question 199 · Select all that apply

A company is using an organization in AWS Organizations to manage hundreds of AWS accounts. A solutions architect is working on a solution to provide baseline protection for the Open Web Application Security Project (OWASP) top 10 web application vulnerabilities. The solutions architect is using AWS WAF for all existing and new Amazon CloudFront distributions that are deployed within the organization. Which combination of steps should the solutions architect take to provide the baseline protection? (Choose three.)

AEnable AWS Config in all accounts (correct answer)
BEnable Amazon GuardDuty in all accounts
CEnable all features for the organization (correct answer)
DUse AWS Firewall Manager to deploy AWS WAF rules in all accounts for all CloudFront distributions (correct answer)
EUse AWS Shield Advanced to deploy AWS WAF rules in all accounts for all CloudFront distributions
FUse AWS Security Hub to deploy AWS WAF rules in all accounts for all CloudFront distributions

Reveal answer & explanation

Correct answer: A, C, D

The correct answer is A, C, D. Option A: Enable AWS Config in all accounts Option C: Enable all features for the organization Option D: Use AWS Firewall Manager to deploy AWS WAF rules in all accounts for all CloudFront distributions

Explanation

SAP-C02 Question 200

Single page →

Topic 1 · Question 200 · Select all that apply

A solutions architect has implemented a SAML 2.0 federated identity solution with their company's on-premises identity provider (IdP) to authenticate users' access to the AWS environment. When the solutions architect tests authentication through the federated identity web portal, access to the AWS environment is granted. However, when test users attempt to authenticate through the federated identity web portal, they are not able to access the AWS environment. Which items should the solutions architect check to ensure identity federation is properly configured? (Choose three.)

AThe IAM user's permissions policy has allowed the use of SAML federation for that user.
BThe IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal. B. Test users are not in the AWSFederatedUsers group in the company's IdP. (correct answer)
CThe web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML provider, the ARN of the IAM role, and the SAML assertion from IdP. (correct answer)
DThe on-premises IdP's DNS hostname is reachable from the AWS environment VPCs.
EThe company's IdP defines SAML assertions that properly map users or groups. In the company to IAM roles with appropriate permissions. (correct answer)

Reveal answer & explanation

Correct answer: B, C, E

The correct answer is B, C, E. Option B: The IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal. B. Test users are not in the AWSFederatedUsers group in the company's IdP. Option C: The web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML provider, the ARN of the IAM role, and the SAML assertion from IdP. Option E: The company's IdP defines SAML assertions that properly map users or groups. In the company to IAM roles with appropriate permissions.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

Showing questions 181–200 of 529 · Page 10 of 27