Exams Practice Exam Questions and Answers – Part 15/15

Answer: A. Use AWS Web Application Firewall (AWS WAF) with Amazon CloudFront distribution

AWS WAF inspects web requests at the edge to block common application-layer exploits like SQL injection and cross-site scripting. Security Hub, Firewall Manager, and Route 53 provide security posture management or DNS routing, not request-level attack prevention.

Answer: C. Use Amazon S3 Glacier vault to store the sensitive archived data and then use a vault lock policy to enforce compliance controls

Amazon S3 Glacier Vault Lock enforces compliance controls via a write-once-read-many policy to prevent future alterations. Lifecycle policies and Access Control Lists manage object transitions and basic permissions, but they cannot enforce strict regulatory retention rules.

Answer: B,D. Use AWS Systems Manager Automation with the AWSEC2-PatchLoadBalancerInstance document to manage patching || Configure Systems Manager Maintenance Windows to coordinate patching and instance removal from the ALB during the defined window

AWS Systems Manager Maintenance Windows schedule patching operations, and the dedicated automation document safely deregisters targets before patching. This coordination prevents traffic disruptions during patching. Manually altering configurations or disabling network interfaces introduces unnecessary risk and does not scale.

Answer: C. Use Reserved Instances for the baseline level of traffic and configure EC2 Auto Scaling with Spot Instances to handle spikes in message volume

A blended purchasing strategy uses Reserved Instances for steady baseline capacity and Spot Instances for unpredictable traffic spikes, optimizing costs. However, because the scenario demands no downtime despite Spot Instance interruptions, relying solely on Spot for spikes is arguably ambiguous without explicit fallback policies.

Answer: A,C. Use AWS WAF geo match statement listing the countries that you want to block || Use AWS WAF IP set statement that specifies the IP addresses that you want to allow through

AWS WAF uses geo match statements to block or allow traffic from specific countries. You can combine this with an IP set statement to explicitly allow specific IP addresses, such as those of your remote development team.

Answer: C. Amazon EC2 with Amazon EBS volume of Provisioned IOPS SSD (io1) type

Provisioned IOPS SSD volumes are designed to deliver predictable, high-performance database workloads. Because the engineering team wants strict control over the database and high IOPS, running it on an EC2 instance with this storage type is the right fit.

Answer: B. Use Amazon ElastiCache for Redis

Amazon ElastiCache for Redis enhances database performance by caching data and supports advanced data structures like geospatial indexing. Memcached does not support geospatial data, making Redis the required choice.

Answer: C. Use Amazon Transcribe to convert audio files to text and Amazon Athena to perform SQL based analysis to understand the underlying customer sentiments

Amazon Transcribe converts audio files to text, and Amazon Athena runs ad-hoc SQL queries directly against data stored in Amazon S3. This pairing provides a serverless pipeline for analyzing the transcribed text.

Answer: C. Use AWS PrivateLink to create a private endpoint within the application's VPC that connects securely to the SaaS provider's VPC

AWS PrivateLink provides private connectivity between VPCs and supported SaaS applications without exposing traffic to the public internet. VPC peering lacks granular access controls and could allow unsolicited inbound traffic, making PrivateLink the superior and more secure choice.

Answer: D. Create an Amazon S3 bucket configured with server-side encryption using AWS KMS multi-Region keys (SSE-KMS). Enable cross-Region replication (CRR) on the source bucket. Use Amazon Athena to run SQL queries on the data

Amazon Athena is a serverless query service that analyzes S3 data using standard SQL without managing infrastructure. Using S3 with AWS KMS multi-Region keys allows seamless cross-Region replication while maintaining least operational overhead.

Answer: B. Enable detailed monitoring on all EC2 instances and use Amazon CloudWatch metrics to track performance

Enabling detailed monitoring on EC2 instances changes CloudWatch metric intervals from five minutes to one minute, meeting the requirement for frequent visibility. This native integration provides the fastest implementation and lowest maintenance compared to custom log pipelines.

Answer: A. Deploy the visualization tool in the same AWS region as the data warehouse. Access the visualization tool over a Direct Connect connection at a location in the same region

Deploying the visualization tool in the same AWS Region as the data warehouse avoids transferring large query results over the network. Accessing the small web pages over Direct Connect minimizes data transfer egress costs compared to querying on-premises.

Answer: D. The CNAME record will be updated to point to the standby database

During a failover in an Amazon RDS Multi-AZ deployment, Amazon RDS automatically updates the DNS CNAME record to point to the standby replica. This ensures the connection endpoint URL remains the same without requiring manual intervention.

Answer: A. Use Amazon EFS with encryption enabled. Create an AWS Transfer Family SFTP endpoint in a VPC with Elastic IP addresses. Restrict access using a security group that allows traffic only from known IPs. Manage user access using POSIX identity mappings and IAM policies

Amazon EFS provides scalable, low-latency file storage natively supported by AWS Transfer Family for high-IOPS SFTP workloads. Deploying the SFTP endpoint within a VPC allows security groups to restrict access to trusted IP addresses, while POSIX mappings handle permissions.

Answer: A. Use Amazon Athena to run SQL based analytics against Amazon S3 data

Amazon Athena is a serverless interactive query service that analyzes data directly in Amazon S3 using standard SQL. It requires no infrastructure management, making it the most cost-effective and easiest to maintain solution compared to provisioning Redshift, EMR, or RDS clusters.

Answer: A. Transfer the on-premises data into multiple AWS Snowball Edge Storage Optimized devices. Copy the AWS Snowball Edge data into Amazon S3 and create a lifecycle policy to transition the data into Amazon S3 Glacier

AWS Snowball Edge Storage Optimized is optimal for securely transferring petabytes of data to AWS. The data must first be imported into Amazon S3 before a lifecycle policy can transition it to S3 Glacier, as Snowball does not write directly to Glacier.

Answer: A. Create an Amazon S3 bucket with Intelligent-Tiering enabled. Update the application to store and retrieve project files using the Amazon S3 API

Amazon S3 Intelligent-Tiering automatically moves objects between access tiers based on changing usage patterns, optimizing costs for unpredictable workloads. Refactoring to use the S3 API provides the most cost-effective and durable storage compared to maintaining EFS or FSx file systems.

Answer: B,C. Create a service control policy (SCP) that denies the ec2:RunInstances API action unless the required tag key is present in the request. Create a second SCP that denies the ec2:DeleteTags action for EC2 resources. Attach both SCPs to the relevant OU in AWS Organizations || Define a tag policy in AWS Organizations that enforces the dataClassification key and restricts values to 'confidential' and 'public'. Attach this tag policy to the applicable organizational unit (OU) to enforce uniform tagging behavior across accounts

Service Control Policies can explicitly deny the RunInstances and DeleteTags API actions unless specific tagging conditions are met. Additionally, AWS Organizations tag policies enforce standardized tag keys and values, effectively eliminating the operational overhead of custom lambda remediation.

Answer: A. Enable Amazon S3 Transfer Acceleration (Amazon S3TA) for the Amazon S3 bucket. This would speed up uploads as well as downloads for the video files

Amazon S3 Transfer Acceleration and Amazon CloudFront both leverage edge locations to optimize global file transfers. However, CloudFront is primarily designed for downloads, making Transfer Acceleration the technically superior AWS service for accelerating large file uploads.

Answer: A,D. Enable the automated backup feature of Amazon RDS in a multi-AZ deployment that creates backups across multiple Regions || Use cross-Region Read Replicas

Cross-Region Read Replicas and Cross-Region Automated Backups provide regional disaster recovery capabilities. Option A is slightly imprecise because automated backups do not inherently span Regions unless explicitly copied, creating slight ambiguity.

Answer: B,D. Create a Network Load Balancer (NLB) in each Region to handle the EC2-based TCP traffic. For the UDP-based on-premises workload, configure NLBs in each Region to route to the on-premises endpoints via IP-based target groups || Configure an AWS Global Accelerator standard accelerator, and register the TCP-based EC2 workloads behind the load balancers

AWS Global Accelerator leverages the AWS global network to route TCP traffic to the closest healthy regional endpoints. Network Load Balancers are required here because they support both TCP and UDP protocols, whereas Application Load Balancers only support Layer 7.