AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 14/16

Answer: C,D,F. Add an RDS MySQL Read Replica in each Availability Zone. || Implement sharding to distribute the incoming load to multiple RDS MySQL instances. || Deploy an Amazon ElastiCache Cluster with nodes running in each Availability Zone.

Read Replicas, database sharding, and ElastiCache horizontally scale read capacity to relieve database bottlenecks cost-effectively. Upgrading instance types or provisioned IOPS represents vertical scaling, which is often cost-prohibitive and less efficient.

Answer: D. Configure AWS Organizations to group different accounts into separate Organizational Units (OU) depending on the business function. Create a Service Control Policy that restricts launching any AWS resources without a tag by including the Condition element in the policy which uses the ForAllValues qualifier and the aws:TagKeys condition. This policy will require its principals to tag resources during creation. Apply the SCP to the OU which will automatically cascade the policy to individual member accounts.

Applying a Service Control Policy using the ForAllValues qualifier with the aws:TagKeys condition enforces mandatory tagging across an organizational unit centrally. Applying individual IAM policies to every account requires extensive operational overhead, whereas AWS Config or Systems Manager only identify non-compliance after creation.

Answer: C,E. Add Read Replicas in RDS for each Availability Zone. || Implement a caching system using ElastiCache in-memory cache on each Availability Zone.

Implementing ElastiCache reduces database load by serving frequent queries from memory, and adding RDS Read Replicas scales read capacity across availability zones. Upgrading the database instance size or implementing sharding is not as cost-effective for handling sudden read spikes.

Answer: B. Use AWS Lambda functions to run the backend game logic. Expose the REST APIs by using Amazon API Gateway. Use Amazon DynamoDB with auto-scaling to store the player session data.

Using API Gateway with backend Lambda functions perfectly preserves the existing REST API structure while providing native API key handling and traffic throttling. DynamoDB provides the low-latency scalability required for active player session data, unlike Aurora Serverless.

Answer: D,E. Use the Amazon Connect service to create an omnichannel cloud-based contact center for the agents. || Use an Amazon Lex bot to recognize callers' intent.

Amazon Connect provides a managed cloud contact center, while Amazon Lex integrates AI to recognize caller intent and automate basic tasks. For the SAP exam, remember that Lex uses natural language understanding to power conversational chatbots, unlike Polly which only handles text-to-speech.

Answer: C. Use the AWS Database Migration Service (DMS) and the AWS Schema Conversion Tool (SCT) to convert, migrate, and re-architect the IBM Db2 database to Amazon Aurora. Set up an Auto Scaling group of EC2 instances with an ELB in front to migrate and re-host your IBM WebSphere. Migrate and re-platform IBM MQ to Amazon MQ in a phased approach.

Using DMS to migrate Db2 to Aurora and re-platforming IBM MQ to Amazon MQ provides the required modernization and cost improvements. For the exam, remember that Amazon MQ is the direct migration path for legacy message brokers like IBM MQ, as SQS lacks the required protocols.

Answer: B,F,G. Set up an Amazon RDS Proxy in front of the database layer to automatically route traffic to healthy RDS instances. || Ensure that Multi-AZ is enabled on Amazon Aurora and create one or more Aurora Replicas. || Migrate the Amazon RDS for MySQL cluster to an Amazon Aurora for MySQL cluster.

Migrating to Amazon Aurora MySQL and utilizing RDS Proxy directly targets sub-twenty second failovers while queueing active transactions. Aurora's isolated cache prevents reboot throttling, and the proxy maintains client connections, unlike standard Multi-AZ failovers.

Answer: B. Create an Amazon Aurora MySQL database instance. Create an Aurora Replica and enable Aurora Auto Scaling for the replica. Create an Auto Scaling group of Amazon EC2 instances placed behind an Application Load Balancer with the round-robin routing algorithm. Ensure that the sticky sessions feature is enabled for the ALB.

Aurora Auto Scaling specifically manages read replicas to handle increased connectivity, as you cannot scale the master node. Sticky sessions are required for stateful web applications behind an Application Load Balancer to maintain user experience. Network Load Balancers do not support least outstanding requests.

Answer: D. Launch an SQS queue and develop a custom service which integrates with SQS to buffer the incoming requests. Use a web distribution in CloudFront and Amazon S3 to host the diagrams, images, and other static assets of the mobile app.

Amazon SQS asynchronously buffers incoming write requests, decoupling user submissions from backend processing to prevent timeouts. CloudFront caches media assets at edge locations, improving load times globally. Provisioning massive DynamoDB write capacity is costly, and replacing DynamoDB introduces unnecessary operational overhead.

Answer: A. Configure AWS IAM Identity Center with AWS Organizations to manage SSO access and permissions on AWS. Set up a two-way forest trust relationship between the AWS Directory service and the company Active Directory to allow users to use their corporate credentials when logging in to AWS. Leverage on the third-party integration support of AWS IAM Identity Center.

IAM Identity Center natively integrates with Organizations and supports third-party SAML applications, providing centralized access with minimal management overhead. Setting up a two-way forest trust allows AWS Managed Microsoft AD to synchronize on-premises users. Self-managed AD FS deployments require significant infrastructure maintenance.

Answer: A,C. Use IAM Access Analyzer to review AWS CloudTrail logs and generate a policy template with permissions required by the Lambda functions. || Create a trail in AWS CloudTrail and turn on CloudTrail logging to capture Amazon S3 and Amazon DynamoDB events.

IAM Access Analyzer reviews CloudTrail events to automatically generate fine-grained IAM policy templates based on actual usage. CloudTrail must be enabled to capture the required S3 and DynamoDB API actions. Services like GuardDuty detect threats, while CodeGuru profiles performance rather than IAM activity.

Answer: B,E. Place the Auto Scaling of Amazon EC2 instances behind a Network Load Balancer (NLB). For the domain name, create an Amazon Route 53 entry that points to the Elastic IP address of the NLB. || Set up network ACL rules on the VPC to deny all non-UDP traffic. Ensure that the NACL is associated with the load balancer subnets.

A Network Load Balancer operates at layer four to route UDP traffic and uses static Elastic IP addresses required for AWS Shield Advanced protections. Additionally, configuring network ACLs to deny non-UDP traffic provides an effective layer four firewall to block unwanted protocols.

Answer: B. Import a certificate that is signed by a trusted third-party certificate authority, store it to ACM then attach it in your ALB. Set the Viewer Protocol Policy to HTTPS Only in CloudFront and use an SSL/TLS certificate from a third-party certificate authority which was imported to either ACM or the IAM certificate store.

Configuring the viewer protocol policy as HTTPS Only enforces encryption in transit between the client and CloudFront. Additionally, importing a trusted third-party certificate into AWS Certificate Manager for the Application Load Balancer fulfills the strict requirement for end-to-end HTTPS across the entire architecture.

Answer: D. Create an IPSec VPN connection using either OpenVPN or VPN/VGW through the Virtual Private Cloud service. Prepare an instance of MySQL running external to Amazon RDS. Configure the MySQL RDS instance to be the replication source. Use mysqldump to transfer the database from the Amazon RDS instance to the on-premises MySQL instance and start the replication from the Amazon RDS Read Replica.

Establishing a secure IPsec VPN tunnel encrypts database replication traffic flowing between the AWS VPC and the on-premises data center. Exposing the RDS instance directly to the internet violates fundamental security best practices, making a dedicated private network connection mandatory for compliance.

Answer: C. Enable object-level logging in the S3 bucket to automatically track S3 actions using CloudTrail. Set up an Amazon EventBridge rule with an SNS Topic to notify the IT Compliance team when a PutObject API call with public-read permission is detected in the CloudTrail logs. Launch another CloudWatch Events rule that invokes an AWS Lambda function to turn the newly uploaded public object to private.

Enabling S3 object-level logging in CloudTrail captures detailed API events, allowing EventBridge to trigger near-real-time alerts and automated Lambda remediation. Using scheduled hourly checks introduces unacceptable latency, while services like Trusted Advisor and GuardDuty lack the granular object-level visibility needed here.

Answer: C. Send the raw data directly to Amazon Data Firehose for processing and output the data to an S3 bucket. For archiving, create a lifecycle policy from S3 to Glacier. Use Amazon EMR to process the data stored in S3 and load the processed data into Amazon Redshift.

Amazon Data Firehose efficiently captures real-time streaming IoT data and delivers it to S3 for archiving or Redshift for analytics. Directly writing massive incoming sensor payloads to S3 or DynamoDB bypasses necessary ingestion buffering and creates performance bottlenecks.