AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 11/12

Answer: A. Use an SQS queue to decouple messages from the application and the database.

Using an SQS queue decouples the application from the database, allowing messages to buffer smoothly during traffic spikes. Increasing write-capacity units is a valid distractor for performance, but the prompt specifically asks for the most cost-effective load reduction strategy.

Answer: C. Set up AWS WAF and AWS Shield Advanced on all web endpoints. Launch AWS WAF rules against SQL injection and other common web exploits.

Deploying AWS WAF and Shield Advanced provides scalable, managed protection against sophisticated DDoS attacks, SQL injection, and HTTP floods. Blocking specific IP addresses manually via network ACLs is easily bypassed by distributed attackers and fails to address automated bot traffic.

Answer: A. Use On-Demand EC2 instances for both the master and core nodes and use Spot EC2 instances for the task nodes.

For transient EMR clusters, you should use On-Demand instances for master and core nodes to guarantee cluster stability and HDFS data persistence. Spot instances are perfect for optional task nodes, providing cheap compute capacity that can handle processing without risking the cluster.

Answer: B,D. An AWS Direct Connect link between the VPC and the network housing the internal services. || A network device in your data center that supports Border Gateway Protocol (BGP) and BGP MD5 authentication.

AWS Direct Connect establishes a dedicated, private network connection between your on-premises data center and your VPC. Setting this up requires a customer gateway device that supports Border Gateway Protocol to handle dynamic routing over the virtual interfaces.

Answer: C. Write a Lamda@Edge function that will normalize the query parameters by sorting them in alphabetical order and converting them into lower case. Deploy this function with the CloudFront distribution and set "viewer request" as the trigger to invoke the function.

A Lambda@Edge viewer request function can normalize query strings before CloudFront caches the object, which directly fixes the cache miss problem. CloudFront has no native case-insensitive caching setting, so origin-side proxies fail because the edge cache is already bypassed.

Answer: C. Set up a Tape Gateway to back up your data in Amazon S3 and archive it in Amazon Glacier using your existing tape-based processes.

Tape Gateway provides a virtual tape library interface, letting you use existing on-premises backup software to seamlessly archive data directly into Amazon S3 Glacier. File and Volume Gateways fail because they do not integrate with tape-based backup infrastructure.

Answer: A. Enable Amazon Macie on the S3 buckets to automatically classify the data and detect any objects with personally identifiable information (PII). Determine if the objects with PII have been recently accessed by tracking the GET API calls in AWS CloudTrail.

Amazon Macie uses machine learning to automatically discover and classify sensitive data like PII stored in Amazon S3. CloudTrail tracks the GET API calls to determine access. Inspector only assesses EC2 vulnerabilities, not S3 data.

Answer: C. Create a new member account in AWS Organizations. Enable AWS Security Hub and designate the account as the delegated administrator.

AWS Security Hub centrally aggregates compliance and security findings across organizational accounts using a delegated administrator. GuardDuty alone lacks comprehensive preventive controls. CloudTrail Lake only captures API events without native compliance mapping.

Answer: B. Store I/O files in S3 instead and use SQS to facilitate a group of hosts working in parallel. Include the hosts in an auto scaling group that scales accordingly to the length of your SQS queue.

Storing files in S3 decouples storage from compute, enabling an Auto Scaling group to process jobs from an SQS queue in parallel. EBS volumes cannot be easily shared across multiple instances like S3 objects.

Answer: B. Create an IAM role in each AWS account that requires auditing, with a trust policy that lists the auditor's ARN as a principal. Assign this role read-only permissions to access necessary resources.

IAM roles with cross-account trust policies provide temporary secure access without sharing long-term credentials. Creating IAM users requires managing passwords and access keys, violating security best practices for external guest access.

Answer: A. Set up a DNS active-active failover using latency based routing policy that resolves to an ELB. Configure the 'Evaluate Target Health' attribute to Yes.

Using Route 53 latency-based routing with active-active failover directs user traffic to the healthiest, lowest-latency regional endpoint. Setting Evaluate Target Health to Yes is required so Route 53 automatically removes unhealthy endpoints from consideration.

Answer: D,E. Set up a scheduled Lambda function to search through the list of running EC2 instances within your VPC and determine if any of these are based on unauthorized AMIs. Afterward, publish a new message to an SNS topic to inform the Security team that this occurred and then terminate the EC2 instance. || Set up AWS Config rules to determine any launches of EC2 instances based on non-approved AMIs and then trigger an AWS Lambda function to automatically terminate the instance. Afterward, publish a message to an SNS topic to inform the Security team about the occurrence.

AWS Config rules continuously evaluate EC2 instances against approved AMIs, automatically triggering remediation without impacting deployments. A scheduled Lambda function acts as a valid detective control, terminating unauthorized instances and alerting security post-deployment.

Answer: C. Attach the PowerUserAccess AWS managed policy to the IAM users.

The PowerUserAccess managed policy grants full access to AWS services except IAM and Organizations administration, matching the requirement perfectly. It specifically allows viewing organization details while adhering to least privilege, avoiding the excessive permissions of AdministratorAccess.

Answer: C. 1. Create an IAM role with a policy that allows listing and uploading of the objects in the S3 bucket. Launch the EC2 instance with the IAM role.

Assigning an IAM role to the EC2 instance allows the application to securely retrieve temporary credentials from the instance metadata. This avoids the security risks of embedding long-term access keys directly on the instance. Instance user data is strictly for launch scripts, not credential retrieval.

Answer: D. Create a VPC endpoint policy that restricts access to the specific Amazon S3 bucket. Create an IAM role that grants access to the S3 bucket and attach it to the application EC2 instances. Apply an Amazon S3 bucket policy that only allows access from the VPC endpoint and those using the IAM role.

Attaching an IAM role to the application instances grants necessary permissions to read the bucket securely. Applying a bucket policy that restricts access to the VPC endpoint ensures traffic does not traverse the public internet. IP address restrictions fail because source IPs change within a VPC.

Answer: D,E. Configure the Network Access Control Lists (ACLs) to only allow the required ports to your network. Identify and block common DDoS request patterns to effectively mitigate a DDoS attack by using AWS WAF. || Always add a security group that only allows certain ports and authorized servers and protects your origin servers by putting it behind a CloudFront distribution. Enable AWS Shield Advanced which provides enhanced DDoS attack detection and monitoring for application-layer traffic to your AWS resources.

Securing origin servers behind CloudFront and AWS Shield Advanced provides robust edge protection against distributed attacks. Configuring network access control lists and using AWS WAF rules further limits the attack surface. Simply oversizing compute resources is not a recommended mitigation tactic.