AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 2/4

Answer: A. Create the same resources of Auto Scaling group of EC2 instances for web and application tiers on both regions using AWS CloudFormation StackSets. Enable Amazon S3 cross-Region on the S3 bucket to asynchronously replicate the contents to the secondary region. Create Amazon Route 53 DNS zone entries with a failover routing policy and set the us-west-1 region as the secondary site. For the database tier, create a DynamoDB global table spanning both regions.

DynamoDB global tables provide multi-active, multi-region replication ensuring quick failover and failback for NoSQL workloads. CloudFormation StackSets deploy infrastructure consistently, while Route 53 failover routing and S3 cross-region replication handle traffic and static assets. Avoid RDS MySQL since the scenario specifies NoSQL.

Answer: C. Create a CloudFront distribution with Geo-Restriction enabled to block all of the blacklisted countries from accessing the trading platform.

CloudFront geo restriction blocks access from specific countries directly at the edge, fulfilling compliance while maintaining low latency. Route 53 geolocation cannot actively block traffic or provide edge caching, and managing network ACLs across dynamic IP ranges is unmanageable.

Answer: A. In each new AWS Region, request for SSL/TLS certificates using the AWS Certificate Manager for each FQDN. Associate the new certificates to the corresponding Application Load Balancer of the same AWS Region.

ACM certificates used by Application Load Balancers are regional resources, meaning you must request a new certificate in every region where you deploy. Global CloudFront distributions can use a single certificate from US East, but regional load balancing requires regional certificates. KMS does not issue certificates.

Answer: A. Download and install the Amazon CloudWatch agent in the on-premises servers and send the logs to Amazon CloudWatch Logs. Create a metric filter in CloudWatch to turn log data into numerical metrics to identify and measure application errors. Create a CloudWatch Alarm that monitors the metric filter and immediately notify the IT Operations team for any issues.

The CloudWatch agent securely pushes on-premises logs to CloudWatch Logs, where metric filters extract errors into actionable data. CloudWatch alarms then monitor these metrics to trigger immediate notifications. QuickSight is an analytics tool, not a real-time alerting system.

Answer: B. Deploy the Docker containers using Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 Spot Instances. Ensure that Spot Instance draining is enabled on the ECS agent config. Use Reserved instance for the Amazon RDS database and its read replicas. Create an encrypted Amazon S3 bucket to store the company documents. Create a bucket lifecycle policy that will move the documents to S3 Glacier after three months and will delete objects older than five years.

Using ECS on Spot Instances provides low-cost compute for containers, while Spot Instance draining ensures graceful task migration during interruptions. RDS Reserved Instances optimize database pricing, and an S3 lifecycle policy transitions older documents to Glacier, minimizing storage costs. EFS and On-Demand options are more expensive.

Answer: A. Create two Patch Groups with unique tags that you will assign to all of your EC2 Windows Instances. Associate the predefined AWS-DefaultPatchBaseline baseline on both patch groups. Set up two non-overlapping maintenance windows and associate each with a different patch group. Using Patch Group tags, register targets with specific maintenance windows and lastly, assign the AWS-RunPatchBaseline document as a task within each maintenance window which has a different processing start time.

Creating two patch groups and associating them with non-overlapping maintenance windows ensures instances are patched and rebooted in staggered shifts. Assigning the AWS-RunPatchBaseline document within these windows fulfills the automated patching requirement. Using State Manager or Run Command lacks built-in reboot scheduling control.

Answer: D. Set up a private hosted zone with a domain name of tutorialsdojo.com and specify the VPCs that you want to associate with the hosted zone. Create an A record with a value of database.tutorialsdojo.com which maps to the IP address of the EC2 instance of your database server. Modify the enableDnsHostNames attribute of your VPC to true and the enableDnsSupport attribute to true

A Route 53 private hosted zone resolves internal domain names exclusively within your associated VPCs. By creating an A record mapped to the private IP address of the database, you ensure it remains internally accessible. Avoid public hosted zones or Elastic IPs for internal resources.

Answer: C. Remove the SCPs on the organization's root and apply them to the Production OU instead. Create a temporary Onboarding OU that has an attached SCP allowing changes to Config. Add the new account to this temporary OU and make the required changes before moving it to the Production OU.

Moving service control policies from the root to the Production organizational unit prevents them from applying to a temporary Onboarding unit. This allows the new account to configure AWS Config rules before moving into production. Root-level explicit denies cannot be overridden by child-level allows.

Answer: D. Using the current Direct Connect connection, create a new public virtual interface and input the network prefixes that you want to advertise. Create a new site-to-site VPN connection to the VPC with the BGP protocol using the DX connection. Configure the company network to route employee traffic to this VPN.

Establishing a site-to-site VPN over a public virtual interface on your Direct Connect connection encrypts the traffic while maintaining consistent network performance. A private virtual interface does not support VPN attachments for AWS public endpoints. Remember this public VIF requirement for encrypted Direct Connect.

Answer: A. Launch an AWS CloudFormation stack that contains an Auto Scaling Group of Amazon EC2 instances spanning multiple Availability Zones that are behind an Application Load Balancer. Use the stack to launch an Amazon Aurora MySQL database cluster in a Multi-AZ configuration with a "retain" deletion policy. Create an Amazon Route 53 zone entry for the company's domain name with an Alias record pointed to the ALB.

Using CloudFormation to deploy a multi-AZ Auto Scaling group behind an Application Load Balancer provides the required scalability and availability for the web tier. Pairing this with an Amazon Aurora MySQL cluster offers high database availability. Multi-region deployments add unnecessary costs for this single global product launch.

Answer: C. Configure the CloudFront distribution to enforce secure end-to-end connections to origin servers by using HTTPS and field-level encryption. Configure your origin to add a Cache-Control max-age directive to your objects, and specify the longest practical value for max-age to increase your cache hit ratio.

CloudFront field-level encryption securely encrypts specific sensitive data fields like credit card numbers at the edge before reaching your origin servers. Setting a long Cache-Control max-age directive keeps objects at edge locations longer, directly improving the cache hit ratio.

Answer: B. On AWS Resource Access Manager (RAM), set up a shared services VPC on your central account. Set up VPC peering from this VPC to each VPC on the other accounts. On Amazon Route 53, create a private hosted zone associated with the shared services VPC. Manage all domains and subdomains on this zone. Programmatically associate the VPCs from other accounts with this hosted zone.

Using Route 53 private hosted zones with cross-account VPC associations allows you to share private DNS resolution seamlessly across different AWS accounts. This centralized approach keeps DNS architecture simple and easily queried by participating VPCs. Manually updating name server records across accounts is an anti-pattern that breaks private zone resolution.

Answer: D. Deny access from the IP Address block in the Network ACL. Use AWS Shield Advanced to protect your cloud resources.

Network ACLs provide an immediate stateless block for the offending IP address, and AWS Shield Advanced protects against network and transport layer DDoS attacks. Security groups cannot explicitly deny traffic, making Network ACLs the necessary choice.

Answer: D. Upload the database credentials with a Secure String data type in AWS Systems Manager Parameter Store. Install the AWS SSM agent on all servers. Set up a new IAM role that enables access and decryption of the database credentials from SSM Parameter Store. Associate this role to the EC2 instances. Create an IAM Service Role that will be associated with the on-premises servers. Deploy the application packages to the EC2 instances and on-premises servers using AWS CodeDeploy.

Storing credentials as a Secure String in Systems Manager Parameter Store ensures encryption, while specific IAM roles grant instances least-privilege decryption access. Using AWS CodeDeploy automates the rollout across both EC2 instances and on-premises servers. Elastic Beanstalk cannot deploy to on-premises infrastructure.

Answer: C,E. On Account A, create an authorization to associate its private hosted zone to the new VPC in Account B. || On Account B, associate the VPC to the private hosted zone in Account A. Delete the association authorization after the association is created.

Associating a cross-account VPC with a private hosted zone requires explicit authorization from the hosted zone owner. Account A must authorize Account B, then Account B associates its VPC. Deleting the authorization afterward prevents unauthorized re-associations while maintaining the active link.

Answer: D. Turn off the Reserved Instance (RI) sharing on the master account for all of the member accounts in the Baby products business unit.

The payer account can disable Reserved Instance discount sharing for specific member accounts within AWS Organizations. This prevents the Baby products unit's reservations from applying to other business units. Member accounts cannot configure this directly, and removing them breaks consolidated billing.