AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 15/16

Answer: A. Split the single Lambda function that processes the photos into several functions dedicated for each type of metadata. Create a workflow on AWS Step Functions that will run multiple Lambda functions in parallel. Create another workflow that will retrieve the list of photos for processing and execute the metadata extraction workflow for each photo.

AWS Step Functions provides native orchestration to execute multiple specialized Lambda functions concurrently, dramatically reducing processing time. A single SQS queue cannot easily coordinate parallel processing across different metadata functions because one successful extraction hides the message.

Answer: D. Create database backups every hour and store it in an Amazon S3 bucket with Cross-Region Replication enabled. Store the transaction logs in the same S3 bucket every 5 minutes.

Synchronous cross-AZ replication guarantees an RPO of zero for Availability Zone failures. If planning for a region-wide outage, S3 with Cross-Region Replication for frequent transaction logs is the standard DR pattern to meet strict RPO requirements.

Answer: A. Migrate all media files to an Amazon S3 bucket and use this as the origin for the new CloudFront web distribution. Set up an Elastic Load Balancer with an Auto Scaling of EC2 instances to host the web servers. Use a combination of Cost Explorer and AWS Trusted advisor checks to monitor the operating costs and identify potential savings.

Migrating media files to an S3 bucket and serving them through CloudFront provides high durability and offloads read traffic. Storing static media on EFS or using Storage Optimized instances is unnecessary and drives up costs.

Answer: C,E,F. Send a message to an Amazon Simple Notification Service (Amazon SNS) topic. Have the security team subscribe to the SNS topic. || Use Amazon EventBridge to invoke an AWS Step Function state machine that will remove permissions on the newly created IAM user. || Create a rule in Amazon EventBridge that will check for patterns in AWS CloudTrail API calls with the CreateUser eventName.

EventBridge rules detect CloudTrail CreateUser API calls and trigger Step Functions to revoke permissions while notifying an SNS topic. CloudTrail only records events and cannot proactively send notifications or invoke remediation workflows.

Answer: C. Configure Redshift to have automatic snapshots and do a cross-region snapshot copy to automatically replicate the current production cluster to the disaster recovery region.

Configuring automatic snapshots with cross-region snapshot copy securely backs up your Redshift cluster to a disaster recovery region. Redshift does not support live cross-region replication, making snapshot copies the only viable method for regional disaster recovery.

Answer: A. Use an Amazon EFS volume to store the weather forecast data points. Mount this EFS volume on a fleet of Auto Scaling Amazon EC2 instances behind an Elastic Load Balancer. Create an Amazon CloudFront distribution and point the origin to the ELB. Configure a 15-minute cache-control timeout for the CloudFront distribution.

Mounting an Amazon EFS volume on a fleet of Auto Scaling EC2 instances behind a load balancer provides the distributed storage needed for concurrent access. While storing individual objects in S3 is a viable alternative for static data, it introduces higher retrieval latency compared to EFS, and API Gateway caching has strict size limits.

Answer: D. 1. For each completed data set, compress and concatenate all of the files into a single Glacier archive.

Compressing data sets into a single S3 Glacier archive minimizes storage costs for rarely accessed files, while storing searchable metadata in DynamoDB enables fast lookups. Glacier lacks built-in search capabilities, so querying the vault directly would be highly inefficient and violate the time constraints.

Answer: A. 1. Synchronize the on-premises data to an S3 bucket one week before the migration schedule using the AWS CLI's S3 sync command.

Using the AWS CLI to sync data into S3 before the migration weekend allows delta syncing of changes, effectively overcoming slow internet bandwidth. DataSync or physical terminals are overkill and less cost-effective for a single terabyte over a week.

Answer: B. Record the user's information in Amazon RDS and create a role in IAM with appropriate permissions. When the user uses his/her mobile app, create temporary credentials using the 'AssumeRole' function in STS. Store these credentials in the mobile app's memory and use them to access the S3 bucket. Generate new credentials the next time the user runs the mobile app.

Using IAM roles and the STS AssumeRole function provides temporary, secure credentials for mobile applications without embedding long-term keys. Storing access keys directly inside an app is a severe security risk. Always distribute short-lived credentials dynamically to untrusted client environments.

Answer: C. Create a database export of the on-premises database server and bring it to an AWS Data Transfer Terminal facility. Once the data is imported to AWS, provision an Amazon Aurora MySQL DB instance and load the data. Using the VPN connection, configure replication from the on-premises database server to the Aurora DB instance. Wait until the replication is complete, then update the database DNS entry to point to the Aurora DB instance. Stop the database replication.

Moving the bulk database export to an AWS Data Transfer Terminal overcomes the strict bandwidth limitations of a 50 Mbps VPN. After the initial seed load, AWS DMS can efficiently replicate ongoing incremental changes over the VPN. This hybrid approach minimizes downtime during the final cutover.

Answer: B. Set up an AWS Direct Connect Gateway with two virtual private gateways. Launch and connect the required Private Virtual Interfaces to the Direct Connect Gateway.

A Direct Connect Gateway allows a single physical Direct Connect connection to extend private connectivity to multiple VPCs across different regions. This avoids the high cost of provisioning redundant physical circuits for each specific region. VPC peering cannot bridge on-premises networks directly.

Answer: C. Reconfigure the web application to publish messages to a new Amazon SQS queue. Create an auto-scaling group of Amazon EC2 instances based on the SQS queue length to pull messages from the queue and process the files. Store the processed files on an Amazon S3 bucket.

Using an SQS queue to trigger an EC2 Auto Scaling group provides the required decoupling and handles processing times exceeding Lambda's fifteen minute limit. Storing files in S3 is cheaper than EFS. Avoid Lambda options because long processing times will cause timeouts.

Answer: B. Write infrastructure-as-code to maintain consistency. Use AWS Organizations to centrally orchestrate the deployment of AWS CloudFormation template from the central account. Use CloudFormation StackSets to simplify permissions and automatic provisioning of resources across multiple regions and accounts.

CloudFormation StackSets integrated with AWS Organizations provide native multi-account and multi-region orchestration. This centralized deployment model automatically handles cross-account permissions, making it the recommended approach over manual nested stacks or custom IAM policies.

Answer: B. Store the SSL certificate in IAM and authorize access only to the Security team using an IAM policy. Configure the Application Load Balancer to use the SSL certificate instead of the EC2 instances.

Terminating SSL at the Application Load Balancer allows you to upload the certificate to IAM or ACM, restricting access via IAM policies so developers cannot see it. Storing certificates directly on EC2 instances is a major anti-pattern when load balancers are already in use.

Answer: B. Remove public read access from the S3 bucket. Use CloudFront as the global content delivery network (CDN) service for the photos and use Signed URLs with expiry dates.

Removing public read access and serving the photos through CloudFront using Signed URLs prevents hotlinking while drastically improving global load times. Blocking specific IPs fails because attackers can easily change IPs, making it an ineffective security strategy.

Answer: A,D. Install the AWS Replication Agent in your on-premises virtualization environment. || Use the AWS Application Migration Service to migrate your on-premises workloads to the AWS cloud.

Installing the AWS Replication Agent and using AWS Application Migration Service provides a highly automated lift-and-shift solution for converting virtual machines into EC2 instances. Avoid CloudFormation here because it builds fresh infrastructure rather than migrating existing servers.