AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 12/12

Answer: D. Create a new IAM role for the 3rd-party vendor. Add a permission policy that only allows the actions required by the third party application. Also, add a trust policy with a Condition element for the ExternalId context key. The Condition must test the ExternalId context key to ensure that it matches the unique customer ID from the 3rd party vendor.

Creating an IAM role with a trust policy conditionally checking the External ID securely delegates access without long-term keys. For cross-account access, always rely on STS AssumeRole with an External ID rather than IAM users to prevent confused deputy attacks.

Answer: D. For the data tier, create an Amazon S3 bucket and move the objects of the existing shared file system to it. Use S3 Intelligent-Tiering Storage class to save costs. Use lazy-loading on an Amazon FSx for Lustre filesystem to import the contents of the S3 bucket. Use this filesystem as shared storage for the application tier EC2 instances for the duration of the job and delete it once the job is completed.

Using S3 Intelligent-Tiering for long-term storage combined with a temporary FSx for Lustre file system provides massive cost savings and high throughput. S3 Standard would technically be cheaper for monthly access, making Intelligent-Tiering a slightly ambiguous but acceptable distractor.

Answer: A. The timeout behavior of a NAT instance is that, when there is a connection time out, it sends a FIN packet to resources behind the NAT instance to close the connection. It does not attempt to continue the connection which is why some database updates are failing. For better performance, use a NAT Gateway instead.

A NAT instance sends a FIN packet to terminate connections upon timeout, breaking long-running patch downloads. Upgrading to a managed NAT Gateway solves this because it actively manages timeouts and provides superior, scalable bandwidth for your VPC.

Answer: B. Create an identity broker that authenticates against the on-premises LDAP server and then calls AWS STS to assume an IAM role, generating temporary AWS security credentials. The employees can use these credentials to access AWS resources.

A custom identity broker authenticates users against the on-premises LDAP server and requests temporary credentials via STS. Option A uses GetFederationToken while Option B uses AssumeRole, and both are technically valid AWS federation patterns for an LDAP integration.

Answer: C,E. For presigned URLs, specify the algorithm using the x-amz-server-side​-encryption​-customer-algorithm request header || For Amazon S3 REST API calls, use the following HTTP Request Headers: x-amz-server-side​-encryption​-customer-algorithm x-amz-server-side​-encryption​-customer-key x-amz-server-side​-encryption​-customer-key-MD5

SSE-C requires specific HTTP headers to pass the encryption algorithm, key, and MD5 during REST API calls. HTTPS is required for transit. The console does not support SSE-C uploads. WebSocket Secure is irrelevant.

Answer: A. Add an in-memory datastore using Amazon ElastiCache for Redis to reduce the burden on the database. Enable Redis replication to scale database reads and to have highly available clusters.

Amazon ElastiCache provides an in-memory datastore reducing latency for frequent database reads. Migrating a dynamic portal to S3 static hosting fails because readers submit comments. Database migrations take longer to implement.

Answer: C. Add another tier to the application by using AWS Step Functions and AWS Lambda to facilitate the different stages of processing. Use a combination of Amazon Textract and Amazon Comprehend to perform optical character recognition (OCR) and parse data from the scanned forms. Store the output in another Amazon S3 bucket. Update the application to parse data from the Amazon S3 bucket and send it to the other system via API call.

Amazon Textract extracts printed text and structured data from scanned forms, while Amazon Comprehend uses natural language processing to parse the extracted text. Building this serverless pipeline with Step Functions and Lambda provides a fully managed, low-overhead automation solution.

Answer: A. Use Amazon WorkSpaces applications (formerly Amazon AppStream 2.0) to centrally manage your desktop applications and improve the overall user experience. Migrate the MySQL database from your VM to Amazon Aurora. Host the application and presentation layers in an Auto Scaling group on Amazon EC2 instances behind an Application Load Balancer.

Streaming desktop applications via AppStream 2.0 significantly reduces latency for remote users over unreliable networks. Migrating the database to Amazon Aurora and hosting compute tiers behind an Application Load Balancer increases availability. CloudFront cannot stream thick-client desktop applications directly.

Answer: B,D. The expiration date of the pre-signed URL is incorrectly set to expire too quickly and thus, may have already expired when they used it. || The required AWS credentials in the ~/.aws/credentials configuration file located on the EC2 instances of the online portal were misconfigured

Presigned URLs require valid AWS credentials to generate and can fail if the expiration window passes before upload. For EC2 workloads, use IAM instance profiles instead of static credential files to ensure applications can reliably generate presigned URLs.

Answer: A. Launch an EC2 instance for both the NGINX server as well as for the database. Attach EBS volumes to the EC2 instance of the database and then use the Data Lifecycle Manager to automatically create scheduled snapshots against the EBS volumes.

Data Lifecycle Manager automates EBS snapshot schedules, which is the native way to back up self-managed databases on EC2. Amazon RDS does not support Oracle RAC, so you must deploy the database on EC2 and cannot use automated RDS features.

Answer: E. Deploy a new Windows AMI for an Auto Scaling group with a minimum size of three instances and spans across three Availability Zones (AZs). Create an Amazon FSx for Windows File Server file system that will be used for shared storage. Write a user data script to install the CMS application, mount the FSx for Windows File Server file system and join the instances to the AD domain.

Amazon FSx for Windows File Server provides fully managed shared storage supporting Windows ACLs and Active Directory integration across Availability Zones. EFS uses Linux POSIX permissions. EBS Multi-Attach restricts instances to a single zone.

Answer: E. Use AWS IoT Core with MQTT to create a new Data-ATS endpoint. Update the Route 53 DNS zone record to point to the new endpoint and allow the IoT devices to send data using the MQTT protocol. Create an AWS IoT rule to directly insert the data into the Amazon DynamoDB table.

AWS IoT Core provides a managed MQTT broker that scales automatically and uses rules to route messages directly to DynamoDB. Managing custom EC2 brokers with load balancers introduces unnecessary operational overhead compared to serverless IoT.

Answer: B. Launch the Windows Server on EC2 instances. Use AWS Systems Manager Patch Manager to manage the patching process for the server. Configure it to automatically apply patches as they become available, ensuring that the server is always up-to-date with the latest operating system upgrades.

AWS Systems Manager Patch Manager automates OS patching on EC2 instances and allows flexible scheduling outside standard windows. Custom Lambda functions or CloudShell introduce unnecessary complexity and manual administrative overhead.

Answer: E. 1. Launch a new CloudTrail trail using the AWS console with one new S3 bucket to store the logs and with the "Enable for all accounts in my organization" checkbox enabled.

Creating an organization trail in AWS CloudTrail centrally captures management events across all accounts and regions automatically. Enabling KMS encryption and MFA Delete on the S3 bucket provides the highest level of security and durability for audit logs.

Answer: C. 1. Configure SSL VPN on the public subnet of your VPC.

Configuring an SSL VPN in a public subnet alongside application servers in a private subnet safely grants employees remote access. The question format is broken, but the core concept remains: keep private resources isolated while enabling authorized external connectivity.