AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 5/8

Answer: A. Create an Amazon S3 bucket to host the static contents. Set this bucket as the origin for an Amazon CloudFront distribution. Write a Lambda@Edge function to parse the User-Agent HTTP header and serve the appropriate contents based on the user's device type.

Using an S3 bucket with CloudFront and Lambda@Edge offloads static content delivery and dynamically routes traffic based on device headers. Caching based on the raw User-Agent header is an anti-pattern due to cache fragmentation, and Network Load Balancers cannot inspect Layer 7 headers.

Answer: B,E. Create a forwarding rule inside the endpoint to forward any queries for private.tutorialsdojo.com to the IP addresses of the two domain controllers. || Create an outbound endpoint on the Amazon Route 53 console. Set the AmazonProvidedDNS as the DNS resolver for the VPC.

A Route 53 Outbound Resolver endpoint forwards DNS queries from your VPC to your Managed Microsoft AD domain controllers. Associate it with a forwarding rule so instances using AmazonProvidedDNS can seamlessly resolve both custom domains and VPC interface endpoints.

Answer: B,E,F. Generate a migration readiness assessment report with the AWS Cloud Adoption Readiness Tool (CART) to highlight gaps in organizational skills and processes. || Use the AWS Transform discovery tool to gather information about the running virtual machines and running applications inside the servers. || Use AWS Transform migration assessment jobs and workspaces to estimate migration costs, generate right-sizing recommendations, produce reports, and support migration planning.

AWS Transform automates discovery and calculates migration cost estimates, while CART highlights organizational readiness gaps. On the exam, avoid confusing planning tools like these with execution services like Migration Hub or monitoring tools like X-Ray.

Answer: C. Use AWS Organizations to centrally manage all of your accounts. Group your accounts, which belong to a specific business unit, to individual Organization Units (OU). Create an IAM Role in the production account which has a policy that allows access to the EC2 instances including resource-level permission to terminate the instances owned by a particular business unit. Provide the cross-account access and the IAM policy to every member accounts of the OU.

Service Control Policies only set the maximum allowable permissions guardrails but never grant access. To actually allow specific business units to terminate their own resources, you must use IAM roles with resource-level permissions. This grants precise cross-account access.

Answer: A. Set up an IAM role with permissions to list and write objects to the S3 bucket. Attach the IAM role to the EC2 instance which will enable it to retrieve temporary security credentials from the instance metadata and use that access to upload the photos to the S3 bucket.

Attaching an IAM role to an EC2 instance allows applications to retrieve temporary credentials securely from instance metadata. This avoids embedding static credentials. User data is merely a launch script and cannot provide rotating credentials.

Answer: A. Replatform

The replatform strategy involves making a few cloud optimizations to achieve benefits without changing the core architecture. Moving to managed services like RDS perfectly fits this lift, tinker, and shift approach. Rehosting requires no architectural changes.

Answer: A,E. Modify the associated IAM Role assigned to the developers by removing the policy that allows them to terminate EC2 instances in production. || Add tags to the EC2 instances in the production environment and assign the developers a role with a policy that denies terminating the instance based on the tag.

Removing EC2 termination permissions directly enforces least privilege, while applying resource tags combined with an explicit deny IAM policy scales securely across environments. Remember that security groups manage network traffic, MFA only gates authentication, and PowerUserAccess still grants broad destructive permissions.

Answer: A. Create an IAM Role and assign the required permissions to read and write from the DynamoDB table. Have the instance profile property of the application instance reference the role.

Assigning an IAM role to an instance profile securely grants temporary credentials to applications running on EC2 instances. Never embed long-term IAM user access keys in user data or attempt to pass role ARNs through Systems Manager for authentication.

Answer: C. Generate a Public Certificate in ACM. Configure the Application Load Balancer to use the Public Certificate to handle HTTPS requests.

Public certificates provisioned in AWS Certificate Manager are free and integrate natively with Application Load Balancers to terminate HTTPS. Private certificates incur hourly operational costs for the certificate authority and public certificates cannot be exported to EC2 instances.

Answer: A. Enable S3 Transfer Acceleration on the central S3 bucket. Use the s3-accelerate endpoint to upload the images.

Amazon S3 Transfer Acceleration leverages Amazon CloudFront edge locations to route uploads over an optimized AWS network path, significantly improving global transfer speeds. CloudFront POST limits and basic multipart uploads fail to address continental latency effectively.

Answer: D. Set up a new S3 bucket with standard storage to store and serve the scanned files. Use Amazon OpenSearch Service for query processing and use Elastic Beanstalk to host the website across multiple availability zones.

Amazon S3 provides highly durable storage for the scanned files, while Amazon OpenSearch handles robust querying. Elastic Beanstalk simplifies web hosting across multiple availability zones. Option A fails because S3 alone lacks robust native search indexing capabilities.

Answer: B,C. Use CloudFront as a Content Delivery Network to load the articles much faster anywhere in the globe. || Use Amazon RDS Multi-AZ deployments with Read Replicas. Use S3 to store the static data such as the cover images and other media.

CloudFront provides low-latency global content delivery for readers. Amazon RDS Multi-AZ with Read Replicas offers high availability and read scaling, while S3 stores static media. Option D fails because EBS volumes lack the durability and scalability of S3.

Answer: B. On the CloudFormation template, create an AWS Secrets Manager secret resource for the database password. Modify the application to retrieve the database password from Secrets Manager when it launches. Use a dynamic reference for the secret resource to be placed as the value of the MasterUserPassword property of the AWS::RDS::DBInstance resource.

AWS Secrets Manager secures the password and handles automatic rotation. Using a dynamic reference in CloudFormation safely passes the value to RDS without exposing it. Option C fails because passing plain text parameters is highly insecure.

Answer: A. Authenticate using your on-premises SAML 2.0-compliant identity provider (IDP), retrieve temporary credentials using STS, and grant federated access to the AWS console via the AWS IAM Identity Center.

SAML 2.0 federation integrates on-premises identities with AWS via IAM Identity Center for console access. This avoids creating duplicate IAM users while maintaining secure single sign-on. Option B fails because AssumeRoleWithWebIdentity targets public identity providers, not corporate directories.

Answer: D,E. Use an SSL/TLS certificate provided by AWS Certificate Manager (ACM). || Configure the CloudFront origin to add a Cache-Control max-age directive to your objects and specify the longest practical value for max-age.

Using an SSL certificate from ACM secures custom domain traffic over HTTPS, while configuring Cache-Control max-age directives increases the cache hit ratio for better performance. Remember that Lambda@Edge customizes content but does not directly increase the cache hit ratio.

Answer: B. Create an Origin Access Control (OAC) and associate it with your CloudFront distribution. Change the permissions on your Amazon S3 bucket so that only the origin access control has read permission.

Creating an Origin Access Control and associating it with your CloudFront distribution ensures users can only access the S3 content via CloudFront. OAC is the modern replacement for Origin Access Identity and is the recommended best practice for securing S3 origins.

Answer: C. Create an Application Load Balancer (ALB) in the us-west-1 region that spans multiple Availability Zones (AZs) of the VPC. Create an Auto Scaling group that will deploy EC2 instances across the multiple AZs and place it behind the ALB. Set up the same configuration to the us-east-1 region VPC. Create record entries in Amazon Route 53 pointing to the ALBs with health check enabled and a failover routing policy.

Configuring a standalone Application Load Balancer and Auto Scaling group in each region with Route 53 failover routing properly establishes a passive backup. Remember that Auto Scaling groups and load balancers cannot span across multiple AWS regions.

Answer: D,E. Use CloudFront to add a custom header to all origin requests. Using AWS WAF, create a web rule that denies all requests without this custom header. Associate the web ACL to the Application Load Balancer. || Create a special CloudFront user called an origin access control (OAC) and associate it with your distribution. Configure the S3 bucket policy to only access from the OAC.

Use CloudFront Origin Access Control to restrict direct public access to the private S3 bucket. For the Application Load Balancer, configure CloudFront to pass a custom secret header, and use AWS WAF to block any requests missing it.