AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 1/4

Answer: A. Set the DeletionPolicy on the RDS resource to snapshot and set the S3 bucket to retain.

Setting the DeletionPolicy to Snapshot for RDS creates a final backup, while Retain on the S3 bucket preserves the objects during stack deletion. Remember that S3 does not support the Snapshot DeletionPolicy, only Retain or Delete.

Answer: B. Provision a table in DynamoDB containing an item for each user having the necessary attributes to hold the user preferences. The mobile app will query the user preferences directly from the table. Use STS, Web Identity Federation, and DynamoDB's Fine-Grained Access Control for authentication and authorization.

Using DynamoDB with web identity federation and fine-grained access control provides a highly scalable, secure, and cost-effective solution for small user preference data. RDS is not as cost-effective for simple key-value profile lookups across millions of users.

Answer: B. SCPs do not affect any service-linked role. Service-linked roles enable other AWS services to integrate with AWS Organizations and can't be restricted by SCPs.

Service Control Policies explicitly do not affect service-linked roles because these roles are integral to AWS service functionality. If you need to restrict an action performed directly by an AWS service, you must block the user or role invoking the service instead.

Answer: C. Use the AWS Schema Conversion Tool (SCT) to convert the source schema to match that of the target database. Migrate the data using the AWS Database Migration Service (DMS) from the source database to an Amazon RDS for PostgreSQL database.

For heterogeneous migrations, the AWS Schema Conversion Tool automatically converts the source database schema and code to match the target PostgreSQL database. AWS Database Migration Service then securely migrates the actual data. Other tools do not handle schema transformations natively.

Answer: A. Use AWS Serverless Application Model (AWS SAM) and set up AWS CodeBuild, AWS CodeDeploy, and AWS CodePipeline to build a CI/CD pipeline.

The AWS Serverless Application Model seamlessly integrates with AWS CodePipeline, CodeBuild, and CodeDeploy to build, test, and deploy serverless applications. It natively supports gradual deployment strategies like canary and linear deployments for Lambda functions. Elastic Beanstalk is intended for EC2 workloads, not serverless architectures.

Answer: B. Use the awsvpc network mode in the task definition in your Amazon ECS Cluster. Attach security groups to the ECS tasks then use IAM roles for tasks to access other resources.

Using the awsvpc network mode assigns each task its own elastic network interface, allowing granular security group attachments directly to containers. IAM roles for tasks grant temporary database credentials without hardcoding sensitive information. The bridge network mode restricts this container-level security visibility.

Answer: C. Use AWS Organizations and Service Control Policies to control the list of AWS services that can be used by each member account.

AWS Organizations combined with Service Control Policies provides centralized governance to restrict available AWS services across multiple accounts. SCPs act as guardrails affecting all accounts within an Organizational Unit, while IAM policies manage granular resource access within those accounts.

Answer: D. Enable the Requester Pays feature in all of the startup's S3 buckets to make the media company pay the cost of the data transfer from the buckets.

Enabling Requester Pays on the S3 buckets shifts the data transfer and request costs to the media company accessing the data. Standard cross-account access alone still charges the bucket owner for all data transfer out of the bucket.

Answer: B,D. Set up a patch baseline that defines which patches are approved for installation on your instances using AWS Systems Manager Patch Manager. || Use the AWS Config Managed Rule which automatically checks whether your running EC2 instances are using approved AMIs. Set up CloudWatch Alarms to notify you if there are any non-compliant instances running in your VPC.

Systems Manager Patch Manager handles the automated security patching, while AWS Config rules monitor for unapproved AMIs. GuardDuty is a threat detection service and does not evaluate patch levels or approved AMIs.

Answer: D. Create an AWS Snowball import job to request for a Snowball Edge device. Use the AWS Schema Conversion Tool (SCT) to process the on-premises data warehouse and load it to the Snowball Edge device. Install the extraction agent on a separate on-premises server and register it with AWS SCT. Once the Snowball Edge imports data to the S3 bucket, use AWS SCT to migrate the data to Amazon Redshift. Configure a local task and AWS DMS task to replicate the ongoing updates to the data warehouse. Monitor and verify that the data migration is complete.

Using AWS Snowball Edge with the AWS Schema Conversion Tool extracts the massive dataset offline, bypassing the slow connection. AWS DMS then replicates the ongoing daily changes to Amazon Redshift to complete the migration within the window.

Answer: C. Launch a Spot Fleet using a diversified allocation strategy, with Auto Scaling enabled on each AZ to handle the peak load instead of On-Demand instances. Retain the current setup for handling the steady state load.

A Spot Fleet with a diversified allocation strategy provides the most cost-effective scaling for unpredictable peak loads across multiple Availability Zones. Reserved Instances are ideal for steady-state traffic but lack the cost savings of Spot for peaks.

Answer: A. Convert the Python script cron job to an AWS Lambda function. Configure the S3 bucket event notifications to trigger the Lambda function whenever an object is uploaded to the bucket.

Configuring S3 event notifications to trigger an AWS Lambda function processes each file immediately upon upload with minimal operational overhead. Using EventBridge or CloudTrail for S3 upload events adds unnecessary complexity for this specific use case.

Answer: D. Go to the Auto Scaling Groups section in the AWS console and suspend the "Terminate" process for the ASG. Log in to one of the unhealthy instances using AWS Systems Manager Session Manager.

Suspending the Terminate process for the Auto Scaling group stops the replacement cycle, keeping the failing instance alive so you can log in via Systems Manager. Relying on termination protection fails because the Auto Scaling group can override it to maintain capacity.

Answer: A. Set up a cloud-based contact center using the Amazon Connect service. Create a conversational chatbot using Amazon Lex with automatic speech recognition and natural language understanding to recognize the intent of the caller then integrate it with Amazon Connect. Connect the solution to various business applications and other internal systems using AWS Lambda functions.

Amazon Connect provides a cloud-based contact center, while Amazon Lex integrates conversational AI to handle automatic speech recognition and intent understanding. Lambda then executes the backend business logic to fulfill user requests. Comprehend lacks ASR and Polly only provides text-to-speech.

Answer: B,D. Use AWS Config to monitor the compliance of your AWS Organizations. Set up an SNS Topic or Amazon EventBridge that will send alerts to you for any changes. || Create a trail in Amazon CloudTrail to capture all API calls to your AWS Organizations, including calls from the AWS Organizations console and from code calls to the AWS Organizations APIs. Use Amazon EventBridge and SNS to raise events when administrator-specified actions occur in an organization and send a notification to you.

CloudTrail captures AWS Organizations API calls, which Amazon EventBridge can monitor to trigger SNS notifications for unauthorized actions. AWS Config records resource configurations, ensuring continuous compliance monitoring across the organization. Systems Manager does not track these events.

Answer: B. Use CloudFront to cache and distribute the high resolution images and other static assets of the website. Deploy AWS WAF on the Amazon CloudFront distribution to protect the website from common web attacks.

Using Amazon CloudFront offloads traffic by caching heavy static assets directly at the edge, significantly reducing the load on the on-premises origin. Deploying AWS WAF on the CloudFront distribution blocks malicious requests before they ever reach the origin network.