AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 4/4

Answer: A,D. Use an Application Load Balancer (ALB) to reduce the risk of overloading your application by distributing traffic across many backend instances. Integrate AWS WAF and the ALB to protect your web applications from common web exploits that could affect application availability. || Use an Amazon CloudFront distribution for both static and dynamic content of your web applications. Add CloudWatch alerts to automatically look and notify the Operations team for high CPUUtilization and NetworkIn metrics, as well as to trigger Auto Scaling of your EC2 instances.

Using Amazon CloudFront and an Application Load Balancer distributes and absorbs malicious traffic, protecting backend instances from being overwhelmed. Adding AWS WAF further inspects and filters web requests, ensuring application availability without needing Shield Advanced.

Answer: C. Use trusted access by running the enable-sharing-with-aws-organization command in the AWS RAM CLI. Mirror the configuration changes that was performed by the account that previously managed this service.

Enabling trusted access with AWS Organizations allows AWS RAM to perform tasks on your behalf by automatically creating the necessary service-linked role. This is the simplest and most native way to integrate the services. Manually configuring roles or using Systems Manager introduces unnecessary operational overhead.

Answer: A. Upgrade your architecture to use an S3 bucket with cross-region replication (CRR) enabled, as the storage service. Set up an SQS queue to distribute the tasks to a group of EC2 instances with Auto Scaling to dynamically increase or decrease the group of EC2 instances depending on the length of the SQS queue. Use CloudFormation to replicate your architecture to another region.

Using Amazon S3 for object storage easily handles the ever-growing data uploads while an SQS queue decouples the processing tasks. EC2 Auto Scaling then uses the queue length to dynamically adjust compute capacity, resolving the surge issues. EBS volumes are block storage and are difficult to synchronize across scaled instances.

Answer: A. The S3 bucket does not have public read access which blocks the website visitors from seeing the content.

Amazon S3 buckets must explicitly grant public read access to successfully serve static website content to visitors. Without this permission, the bucket blocks all anonymous HTTP requests, resulting in access denied errors. Route 53 alias records route traffic correctly, but the bucket policies dictate actual visibility.

Answer: G. Configure the application to receive the records and set the storage to a DynamoDB table. Configure proper scaling on the DynamoDB table and enable the DynamoDB table Time to Live (TTL) setting to delete records after 120 days.

DynamoDB easily handles massive ingest rates while providing single-digit millisecond latency, and its Time to Live feature automatically deletes expired items at no extra cost. Amazon S3 lacks the low-latency retrieval needed here, and Kafka is not optimized for direct low-latency item lookups.

Answer: B. Purchase Compute Savings Plans for the EC2 nodes of the EKS cluster to be used for regular traffic. Scale the node cluster with Spot instances during peak demands. Handle the predicted database load with a 1-year All Upfront Reserved Instance and vertically scale up the DB instance on scheduled high usage.

Compute Savings Plans handle the predictable baseline, while Spot Instances cheaply absorb the flexible peak loads for containerized workloads. For the database, an All Upfront Reserved Instance yields the maximum discount, and scheduled vertical scaling accommodates the temporary surges.

Answer: B. Distribute traffic to a set of web servers using an Elastic Load Balancer that performs TCP load balancing. Use CloudHSM deployed to two Availability Zones to perform the SSL transactions and deliver your application logs to a private Amazon S3 bucket using server-side encryption.

Deploying CloudHSM across two Availability Zones ensures the highly available termination of SSL transactions entirely within dedicated hardware. Uploading logs to S3 with server-side encryption meets the durability requirement while restricting access to authorized staff.

Answer: G. Use AWS Transform MGN to migrate the virtual machines to AWS. Install the AWS Replication Agent on each server in the application tiers to continuously replicate the root volumes and data volumes to AWS. Launch test instances from the replicated servers, validate the application, and then perform a cutover to launch updated Amazon EC2 instances.

AWS Application Migration Service continuously replicates root and data volumes using an agent, ensuring minimal downtime during the cutover. VM Import/Export lacks continuous synchronization capabilities, resulting in heavy operational overhead for incremental updates.

Answer: D. Set up cross-account access with a resource-based Policy. Use AWS Config rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration.

Resource-based policies attached directly to services like S3 or KMS allow cross-account access without assuming a role, preserving the user's original permissions. AWS Config continuously audits these policy changes to maintain compliance. Remember that roles require surrendering original session permissions.

Answer: B,D. Reduce the load on the database tier by creating an Amazon ElastiCache cluster to cache frequently requested database queries. Configure the application to use this cache when querying the RDS MySQL instance. || Change the target group health check to a simple HTML page instead of a page that queries the database. Create an Amazon Route 53 health check for the database dummy item web page to ensure that the application works as expected. Set up an Amazon CloudWatch alarm to send a notification to Admins when the health check fails.

Using Amazon ElastiCache offloads read-heavy database queries, directly relieving CPU bottlenecks on the RDS instance. Target group health checks should query a simple HTML page instead of a database, preventing unnecessary scaling churn during outages. Route 53 health checks monitor the critical application endpoints externally.

Answer: A. Use AWS WAF to add a web access control list (web ACL) in front of the API Gateway to block requests that contain malicious SQL code. Use AWS Config to track changes to your web access control lists (web ACLs) such as the creation and deletion of rules including the updates to the WAF rule configurations.

AWS WAF attaches directly to API Gateway to inspect incoming requests and block malicious SQL injection patterns at the edge. AWS Config records the configuration changes to web ACLs, allowing you to track historical rule modifications. Firewall Manager manages rules globally across accounts, while Config tracks individual resource configurations.

Answer: H. Create a geolocation routing policy on Amazon Route 53 to point the global users to their designated regions. Combine this with a failover answer routing policy with health checks to direct users to a healthy region at any given time.

Amazon Aurora Global Database provides multi-region read scalability and disaster recovery without sacrificing relational semantics or single-region write availability. Route 53 geolocation routing ensures users hit their local healthy endpoints while safely failing over regionally.

Answer: C. Use Amazon CloudWatch to monitor service quotas published in the AWS/Usage metric namespace. Set up an alarm when the math expression metricId/SERVICE_QUOTA(metricId)*100 is greater than 75. Configure Amazon SNS to send notifications to the operations team.

CloudWatch tracks usage in the AWS/Usage namespace, enabling a math expression using the SERVICE_QUOTA function to calculate quota consumption directly. Avoid creating custom metrics when native Service Quotas integration can trigger alerts natively.

Answer: F. Update the AWS Fargate task definition and set the auto-assign public IP option to DISABLED. Launch a NAT gateway on the public subnet of the VPC and update the route table of the private subnet to route requests to the Internet.

Fargate tasks in private subnets need a route to the internet to pull container images from Amazon ECR. Deploying a NAT Gateway in a public subnet and updating the private subnet route table provides this outbound access securely. A NAT Gateway must reside in a public subnet to reach the internet gateway.

Answer: F. Reconfigure the SQS redrive policy and set maxReceiveCount to 10. This will allow the consumers to retry the messages before sending them to the dead-letter queue.

Setting maxReceiveCount to a low value like one triggers immediate dead-letter routing for transient hiccups. Raising the count to ten allows consumers multiple attempts before discarding messages. The current one-hour visibility timeout correctly covers processing, proving the issue is overly strict retries, not timeouts.