AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 10/12

Answer: D. Add an AWS CodeBuild stage on the deployment pipeline to automatically test on a non-production environment. Leverage change sets on AWS CloudFormation to preview changes before applying to production. Set up a blue/green deployment pattern on AWS CodeDeploy to deploy changes on a separate environment and to quickly rollback if needed.

Integrating CodeBuild automated testing, CloudFormation change sets for safe previews, and CodeDeploy blue-green deployments creates a resilient pipeline that minimizes downtime. Manual testing or relying solely on cfn helper scripts introduces human error and does not guarantee safe automated rollbacks.

Answer: D. Use the AWS Application Discovery Service to gather data about your on-premises data center and perform the TCO analysis.

Application Discovery Service collects configuration and utilization data from on-premises servers to calculate total cost of ownership for migrations. Migration Hub tracks ongoing migrations, while Application Migration Service executes the lift-and-shift but lacks planning discovery features.

Answer: D. Decouple the application and database tier by creating an Amazon SQS queue between them. Create an AWS Lambda function that picks up the messages on the SQS queue and writes them into the database.

Decoupling the application from the database with an SQS queue buffers high volumes of writes during traffic spikes, ensuring no submissions are lost. ElastiCache is a poor distractor because it only accelerates read performance rather than handling persistent write buffering.

Answer: C,E. On the Amazon Aurora cluster's security group, create an inbound rule with the source as the Amazon EC2 instances' security group using the default Aurora port 3306. || On the Amazon EC2 instances' security group, create an outbound rule with the destination as the DB cluster's security group using the default Aurora port 3306.

Configuring outbound traffic on the EC2 security group and inbound traffic on the database security group enforces least privilege. Referencing security groups directly maintains strict isolation, unlike network ACLs which use broad CIDR blocks and operate statelessly.

Answer: C. Configure a Canary deployment configuration for your Lambda function. Enable active tracing to integrate AWS X-Ray to your AWS Lambda function.

A Canary deployment shifts traffic in two increments, matching the requested ten percent followed by the remaining ninety percent. AWS X-Ray traces invocations and downstream calls. Linear shifts traffic in equal increments.

Answer: B. Create an Amazon SQS queue and develop a consumer process to flush the queue to the on-premises database server. Update the application to enable writing to the SQS queue.

Amazon SQS decouples the application writes from the on-premises database, absorbing bursts without causing erratic behavior. Since the system uses an eventual consistency model, temporary queuing is perfectly acceptable and highly cost-effective.

Answer: A. For both the master and core nodes, use On-Demand EC2 instances. For the task nodes, use Spot EC2 instances.

Using On-Demand Instances for EMR master and core nodes guarantees data integrity and cluster stability during the 48-hour run. Spot Instances are optimal for task nodes because they handle transient compute capacity without risking critical data loss.

Answer: C. Using AWS CLI, create a new KMS key with no key material and use EXTERNAL as the origin of the key. Generate a key from the on-premises HSMs and import it as KMS key using the public key and import token from AWS. Apply an Amazon S3 bucket policy on the central logging bucket to require AWS KMS as the encryption source and deny unencrypted object uploads.

Creating a KMS key with an external origin allows you to securely import key material generated by your own on-premises Hardware Security Modules. Applying an S3 bucket policy enforcing SSE-KMS ensures all uploaded logs comply with strict regulatory encryption requirements.

Answer: G. Create an Amazon S3 bucket to store all data. Enable server-side encryption with AWS KMS (SSE-KMS). Apply a bucket policy that enforces HTTPS only connections to the S3 bucket.

Storing data in an Amazon S3 bucket with server-side encryption using AWS KMS satisfies the requirement for customer-managed keys. Applying a bucket policy that denies non-HTTPS requests secures data in transit. This approach provides the highest durability and lowest maintenance for large files compared to EC2 or DynamoDB.

Answer: E. Create an Amazon CloudWatch Alarm to monitor the FreeStorageCapacity metric of the file system. Write an AWS Lambda Function to increase the capacity of the Amazon FSx for Windows File Server file system using the update-file-system command. Utilize Amazon EventBridge to invoke this Lambda function when the metric threshold is reached.

An EventBridge rule can automatically trigger a Lambda function when a CloudWatch alarm detects low free storage capacity. The function uses the update-file-system API to expand Amazon FSx storage transparently. This prevents future outages without requiring a complex data migration to a new file system.

Answer: B,E. Have CloudFront enable caching of re-usable content from your website. || Add a caching layer using Amazon ElastiCache Service to be used for storing sessions and frequent DB queries.

Amazon CloudFront caches reusable static and dynamic content at global edge locations to reduce latency for users. Adding Amazon ElastiCache offloads frequent database queries, reducing database load. Lowering the Auto Scaling threshold merely provisions more compute power without addressing core latency.

Answer: B. Utilize AWS CloudFormation as the deployment service to deploy the needed AWS resources such as an Amazon S3 bucket for storage, OpenSearch to provide the needed search functionality, and an Amazon EC2 instance to host their website.

Amazon S3 provides highly durable and cost-effective object storage for the massive 50 TB dataset. Amazon OpenSearch easily integrates with the dynamic website to provide robust full-text search capabilities. Using Amazon RDS for this specific text search requirement would be unnecessarily expensive.

Answer: G. Reconfigure the pipeline to create a Staging environment on AWS Elastic Beanstalk. Deploy the newer version on the Staging environment. Swap the Staging and Production environment URLs to shift traffic to the newer version.

Using Elastic Beanstalk to deploy a new staging environment allows you to validate the new application version safely. Swapping the CNAMEs instantly shifts traffic to achieve a blue-green deployment. This strategy provides rapid rollbacks by simply reversing the URL swap process.

Answer: A,C,D. Improve the network performance of each node by using Amazon EC2 instances with an Elastic Fabric Adapter (EFA) network interface. || Improve the storage performance by implementing Amazon FSx for Lustre instead of using Amazon EFS. || Improve the performance by placing all the compute nodes as close to each other. Re-launch all the Amazon EC2 instances within a single Availability Zone in a cluster placement group.

For tightly coupled HPC workloads, cluster placement groups, Elastic Fabric Adapters, and FSx for Lustre are the standard high-performance choices. EFS lacks the necessary throughput for intensive simulations, and spreading instances across AZs introduces latency.

Answer: C,E. Set up AWS Service Catalog to tag the provisioned resources with corresponding unique identifiers for portfolio, product, and users. || Set up the CloudFormation Resource Tags property to apply tags to certain resource types upon creation.

CloudFormation natively enforces tags during infrastructure deployment, and Service Catalog enforces tagging rules for self-service provisioning. Avoid reactive tools like AWS Config for tagging; prioritize proactive Infrastructure as Code solutions.

Answer: D. Configure Traffic Mirroring on the elastic network interface of the EC2 instances. Send the mirrored traffic to a monitoring appliance for storage and inspection.

VPC Traffic Mirroring copies actual network packets from EC2 interfaces to security appliances for deep payload inspection. VPC Flow Logs and ALB access logs only provide metadata and header information, not the packet payload required for reverse-engineering attacks.