AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 16/16

Answer: D. Deploy the website across 3 Availability Zones with Auto Scaled EC2 instances behind an Application Load Balancer and a RDS configured with Multi-AZ Deployments.

Deploying Auto Scaled EC2 instances across three Availability Zones behind an Application Load Balancer ensures the web tier can survive failures. Pairing this with an RDS Multi-AZ deployment is critical because Read Replicas only scale reads and do not provide automatic failover.

Answer: C. Use one table every week, with a composite primary key which is the sensor ID as the partition key and the timestamp as the sort key.

Creating weekly DynamoDB tables using the sensor ID as the partition key and timestamp as the sort key enables efficient queries and simple expiration via table deletion. Using a single massive table for all historical data increases complexity, and concatenating keys removes your ability to perform range queries on the timestamp.

Answer: B,D,F. Update the custom AWS KMS key policy in the Marketing account to include decrypt permission for the mgmt_reviewer IAM role. || Add an Amazon S3 bucket policy that includes read permission. Ensure that the Principal is set to the Management team's AWS account ID. || Ensure that the mgmt_reviewer IAM role policy includes read permissions to the Amazon S3 bucket and a decrypt permission to the custom AWS KSM key.

Cross-account access to an encrypted bucket requires granting permissions in both the resource and identity tiers. You must update the KMS key policy and S3 bucket policy in the marketing account, and ensure the management role has the necessary read and decrypt permissions in its IAM policy.

Answer: B,C. Configure an IAM Policy that restricts access only to the user-specific folders in the Amazon S3 Bucket. || Set up a federation proxy or a custom identity provider and use AWS Security Token Service to generate temporary tokens. Use an IAM Role to enable access to AWS services.

Setting up an identity provider with AWS STS allows users to federate their existing Active Directory credentials using IAM roles for access. To restrict access to specific prefixes, attach an IAM policy using variables to lock each user to their designated folder.

Answer: H. Use AWS Secrets Manager, create a secret resource and generate a secure database password. Use Secrets Manager's managed rotation to automatically rotate the database password every 90 days. On AWS CloudFormation, specify the AutomaticallyAfterDays property in RotationRules to set the rotation schedule to 90 days.

AWS Secrets Manager natively handles random password generation and automated RDS credential rotation with minimal overhead using CloudFormation. A strong distractor uses custom Lambda functions for rotation, but that introduces unnecessary operational complexity when native managed rotation exists.

Answer: H. Create an AWS CodeBuild job to run tests and security scans on the generated artifacts. Create an Amazon EventBridge rule that will send Amazon SNS alerts when unit testing fails. Create AWS Cloud Development Kit (AWS CDK) constructs with a manifest file to turn on/off features of the AWS CDK app. Add a manual approval stage on the pipeline for the Lead Developer's approval prior to production deployment.

CodeBuild easily handles automated testing and security scans, while native CodePipeline manual approvals satisfy the lead developer requirement. For dynamic feature toggles, the AWS Cloud Development Kit allows conditional deployments, making it superior to custom Lambda logic.

Answer: C,E. Avail a reserved capacity for provisioned throughput for DynamoDB. || Set up a scheduled job to drop the DynamoDB table for the previous day that contains the biometric data after it is successfully stored in the S3 bucket. Create another DynamoDB table for the day and perform the deletion and creation process everyday.

Purchasing reserved capacity provides significant savings for predictable workloads, while dropping daily tables after successful S3 aggregation minimizes ongoing storage costs. Introducing ElastiCache or shifting to RDS would drastically increase operational overhead and monthly billing.

Answer: G. Leverage AWS AppSync by building GraphQL APIs and using Websockets to deliver comments in real-time.

AWS AppSync leverages GraphQL and WebSocket protocols to efficiently push real-time data updates to subscribed clients. Using short polling via API Gateway increases latency and unnecessarily drives up Lambda invocation costs, making it a poor choice.

Answer: A. Create an Amazon EFS volume and mount it across all the EC2 instances. Use the Provisioned Throughput mode on the EFS volume to ensure that the application can reach the required IOPS.

Creating an Amazon EFS file system using Provisioned Throughput provides a shared file system that meets performance requirements and reduces costs by eliminating duplicate EBS volumes. Max I/O performance mode is outdated and does not guarantee specific throughput independent of storage size.

Answer: B. Create an Amazon ECS Fargate cluster and use containers to host the web application. Create an Auto Scaling group of Amazon EC2 Spot instances to process the SQS queue. Use Amazon Rekognition to analyze and categorize the videos instead of the third-party software. Store the videos and static contents on Amazon S3 buckets.

Using ECS Fargate for the web tier and Spot Instances for queue processing minimizes operational overhead and reduces costs. S3 provides durable storage for media files, while Amazon Rekognition completely removes the third-party software dependency for video analysis.

Answer: D. Amazon DynamoDB with a provisioned write throughput. Use an SQS queue to buffer the large incoming traffic to your Auto Scaled EC2 instances, which processes and writes the data to DynamoDB.

Using an SQS queue acts as a buffer to decouple the write operations, protecting the DynamoDB database from being overwhelmed by sudden traffic spikes. For the exam, always pair SQS with Auto Scaling when dealing with unpredictable, write-intensive workloads to ensure system stability.

Answer: C. Use CloudFormation with Systems Manager Parameter Store to retrieve the latest AMI IDs for your template. Whenever you decide to update the EC2 instances, call the update-stack API in CloudFormation in your CloudFormation template.

Storing the latest AMI IDs in Systems Manager Parameter Store allows CloudFormation to dynamically retrieve the public parameters during stack updates. This avoids manual template edits and eliminates the need for AWS Service Catalog, which is used for governance, not automation.

Answer: B. Install the AWS Client VPN on each employee workstation. Create a Client VPN endpoint in the same VPC region in the main AWS account. Update the VPC route configurations to allow communication with the internal applications.

Installing the client on employee workstations and creating a single Client VPN endpoint in the main account leverages existing VPC peering routes for access. Client VPN is endpoint-based, so deploying it in a data center or across every account adds unnecessary cost and complexity.

Answer: B. Leverage AWS Transform MGN for the migration. Install the AWS Replication agent on each physical machine to start the replication to the AWS Cloud. Once syncing is completed, launch test instances and initiate cutover to the AWS Cloud.

AWS Application Migration Service, formerly known as MGN, is designed to lift and shift physical servers using an agent for continuous block-level replication. Manual VM import processes are not scalable for large migrations, and AWS Outposts is used for extending infrastructure on-premises, not migrating to the cloud.

Answer: B. The mobile app will send device location to an SQS endpoint. Set up an API that utilizes an Application Load Balancer and an Auto Scaling group of EC2 instances, which will retrieve the relevant offers from DynamoDB. Use Amazon SNS to send offers to the mobile app.

Amazon SNS provides native mobile push notifications directly to consumer devices, unlike Amazon SES which only handles email. While using SQS to buffer location updates is an older EC2-based design pattern, it successfully pairs SNS for the required mobile push delivery.

Answer: F,H. Create an Amazon OpenSearch Service domain to reliably ingest the events. Leverage the OpenSearch Dashboards tool to create near-real-time dashboards and visualizations. || Ingest the events using Amazon Data Firehose. Write a Lambda function to process and transform the buffered events.

Amazon Data Firehose provides a fully managed, auto-scaling buffer for streaming data and uses Lambda for transformations. OpenSearch Service natively handles semi-structured JSON data and offers OpenSearch Dashboards for visualization.