AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 6/8

Answer: C. The third-party account should create an External ID that will be given to OrganizationA. The logistics company should then create an IAM role with the required access and put the External ID in the IAM role's trust policy. The third-party account should use the IAM role's ARN and External ID when requesting access to OrganizationA's AWS resources.

Using an External ID in the IAM role trust policy securely delegates cross-account access, preventing unauthorized third-party accounts from assuming the role. Sharing static IAM user credentials violates security best practices, and standard STS assumption lacks the required contextual verification.

Answer: B,C,F. Pull the messages from the on-premises Apache Kafka cluster by using a fleet of Amazon EC2 instances in an Auto Scaling Group. Send the data into an Amazon Kinesis Data Stream by using the Kinesis Producer Library. || To have consistent performance, request for an AWS Direct Connect connection from the on-premises data center to the AWS VPC. || Write an AWS Lambda function to process the Amazon Kinesis data stream and create a WebSocket API in Amazon API Gateway to invoke the function. Send the callback messages to connected clients by using the @connections command for the API.

Direct Connect provides the consistent, high-performance network required for critical production workloads. For the exam, remember that Kinesis Producer Library ingests data, while WebSocket APIs push real-time updates to clients, unlike AppSync GraphQL.

Answer: C. Use an AWS CloudFormation template to launch an Auto Scaling group of Amazon EC2 instances across multiple Availability Zones, which are all connected via an ELB to handle the load balancing. Leverage Amazon CloudFront for distributing your static content and an Amazon RDS instance with a Multi-AZ deployment configuration.

An Auto Scaling group across multiple Availability Zones with a load balancer provides the required scalability and high availability. For OLTP workloads, Multi-AZ RDS provides synchronous standby replication for fault tolerance, whereas Read Replicas only improve performance.

Answer: B. Use Amazon Macie to automatically discover, classify, and protect personally identifiable information (PII) data in the Amazon S3 bucket. Use a lifecycle policy in S3 to move the old photos to Infrequent Access storage class after a month. Re-configure the existing database to use RDS Multi-AZ Deployments.

Amazon Macie is the correct service to automatically discover and protect sensitive personally identifiable information in S3. RDS Multi-AZ provides high availability, and an S3 lifecycle policy to Standard-IA optimizes storage costs for less frequently accessed images.

Answer: D. Push web clicks by session to Amazon Kinesis and analyze behavior using Amazon Kinesis workers.

Kinesis Data Streams ingests massive real-time clickstream data, allowing workers to analyze user behavior instantly. Remember for the exam that batch-oriented services like SQS or EMR cannot provide the immediate sub-second response needed to dynamically alter page layouts.

Answer: C,D. Ensure that the NACL associated with the logging service subnet allows communication to and from the NLB subnets. Ensure that the NACL associated with the NLB subnets allows communication to and from the EC2 instances subnets running the logging service. || Ensure that the security group attached to the EC2 instances hosting the logging service allows inbound traffic from the NLB's security group. Also, ensure that the security group attached to the NLB allows inbound traffic from the interface endpoint subnet.

For AWS PrivateLink, the Network Load Balancer masks the original client IP, meaning target security groups must allow traffic from the NLB. Network ACLs are stateless and must explicitly allow bidirectional traffic between the endpoint, NLB, and target subnets.

Answer: D. Use AWS Directory Service to integrate your AWS resources with the existing Active Directory using trust relationship. Enable single sign-on using Managed Microsoft AD.

Managed Microsoft AD integrates with on-premises Active Directory by establishing forest trusts to extend single sign-on capabilities. While IAM Identity Center handles AWS access, AWS Directory Service is required to connect your existing domain. Cognito is for public apps.

Answer: B. In your VPC, launch a new web proxy server that only allows outbound access to the URLs provided by the proprietary e-commerce platform.

Proxy servers act as relays to filter outbound web requests based on specific URLs. This meets the requirement without breaking inbound connectivity. NAT gateways operate at the IP layer and cannot filter domain names or URLs.

Answer: D. First, create IAM users in the master account. Then in the Dev and Test accounts, generate cross-account roles that have full admin permissions while granting access for the master account.

Cross-account roles are created in the target accounts and specify the master account as a trusted entity. This delegates the necessary permissions without duplicating IAM users. Permissions cannot be inherited simply through consolidated billing.

Answer: D. Provision EC2 servers for both your JBoss application and Oracle database, and then restore the database backups from an S3 bucket. Also provision an EBS volume containing static content obtained from Storage Gateway, and attach the volume to the JBoss EC2 server.

Provisioning Amazon EBS volumes directly from Storage Gateway snapshots provides the fastest recovery path and lowest RTO for static files. Avoid AWS Storage Gateway-VTL or Amazon Glacier for urgent disaster recovery scenarios, as their retrieval times are significantly slower.

Answer: C. You can use a forward web proxy server in your VPC and manage outbound access using URL-based rules. Default routes are also removed.

Deploying a forward web proxy allows you to filter outbound VPC traffic using specific URL domains. Security groups and network ACLs operate at the network layer and cannot inspect HTTP URLs, making them ineffective for domain-based content filtering.

Answer: D. 1. Set the DeletionPolicy on the S3 resource declaration in the CloudFormation template to Retain. 2. Set the RDS resource declaration DeletionPolicy to Snapshot.

Setting the S3 DeletionPolicy to Retain preserves the bucket during stack deletion. Setting RDS to Snapshot backs up the database and stops compute costs when idle. Option B fails because retaining the RDS instance incurs unnecessary charges during the year.

Answer: B. This is due to encryption overhead when copying files to the Snowball Edge device. Open multiple sessions to the Snowball Edge device and initiate parallel copy jobs to improve the overall copying throughput.

Copying millions of small files to Snowball Edge incurs heavy encryption overhead per file. Running multiple parallel copy jobs across terminal sessions drastically improves throughput. Option C fails because clustering increases storage and durability, not single-file transfer speeds.

Answer: C. Create a NAT gateway then specify its corresponding subnet and Elastic IP address. Update the route tables of the private subnet to point the Internet traffic to the NAT gateway.

A managed NAT gateway provides better availability and bandwidth automatically, requiring no administrative effort compared to a NAT instance. For the exam, remember that egress-only internet gateways are strictly for IPv6 traffic, not IPv4.

Answer: C. Deploy the Java application on Amazon EC2 instances within an Auto Scaling group spanning multiple Availability Zones. Migrate the MongoDB database to Amazon DocumentDB (with MongoDB compatibility) across multiple Availability Zones.

Deploying the Java application on EC2 instances in an Auto Scaling group and migrating the database to Amazon DocumentDB across multiple Availability Zones meets all requirements. DocumentDB is crucial here because it offers MongoDB compatibility without requiring application code changes.

Answer: A,E. The MNL-EUR.config and MNL-ASIA.config files will have a Version ID of null. || There would be two available versions for each of the MNL-NA.config, MNL-LA.config, and MNL-O.config files. The first Version ID of MNL-NA.config and MNL-LA.config has a value of null.

When S3 versioning is enabled, existing objects receive a version ID of null, while any new uploads or updates get a unique alphanumeric version ID. A practical exam cue is that versioning does not apply retroactively to unmodified objects.

Answer: D. The availability zone that is not receiving traffic was not associated with the application load balancer.

If an Availability Zone is not associated with the Application Load Balancer, instances in that zone will not receive any traffic. For the exam, remember that Auto Scaling groups can span multiple zones, but the load balancer must be explicitly configured to route traffic there.