AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 7/8

Answer: C. Run the web and application tiers in stateless instances in an autoscaling group, using Amazon ElastiCache Serverless for tier synchronization and CloudWatch for monitoring. Run the database tier using RDS with read replicas, and Multi-AZ enabled.

Running stateless instances in an Auto Scaling group with Amazon ElastiCache Serverless and an RDS database with read replicas and Multi-AZ provides the best scalability and availability. A key exam cue is that stateful instances cannot scale dynamically without losing session data.

Answer: D. Create an Auto-scaling group of spot instance workers that scale according to the queue depth in SQS to process job messages. After the data has been processed, transfer your S3 objects to Amazon Glacier.

Using an Auto Scaling group of Spot Instances driven by Amazon SQS queue depth handles asynchronous photo processing at a low cost. Transitioning the processed Amazon S3 objects to Amazon S3 Glacier provides the required long-term archival storage.

Answer: D. Write an AWS CloudFormation template that contains the AWS::SageMaker::NotebookInstance resource type to launch a Jupyter notebook instance with a preconfigured KMS key. Create Mappings on the CloudFormation to map simpler parameter names for instance sizes such as Small, Medium, Large. Reference the URL of the notebook instance on the Outputs section of the template. Create a portfolio in AWS Service Catalog and upload the template to be shared with the IAM role of the data scientists.

AWS Service Catalog provides a secure self-service portal that allows data scientists to launch predefined Amazon SageMaker AI environments. This approach abstracts complex AWS configuration details while centrally enforcing mandatory security controls like KMS encryption.

Answer: D. Use AWS IoT Core Basic Ingest for data collection. Configure an AWS IoT rule action to send data to Amazon Data Firehose. Set up Data Firehose with an AWS Lambda function for data enrichment and a buffer interval of 300 seconds.

AWS IoT Core Basic Ingest routes messages directly to the Rules Engine, minimizing messaging costs. Routing this data to Amazon Data Firehose provides a fully managed pipeline to batch the incoming sensor data, seamlessly run AWS Lambda transformations, and deliver it to Amazon S3.

Answer: B. Store the order information on an Amazon DynamoDB table. Create an AWS Step Functions workflow that will be triggered for every new order. Have the workflow mark the order as "in progress" and print the shipping label for the package. Once the package is scanned and leaves the warehouse, trigger an AWS Lambda function to mark the order as "shipped" and complete the Step Functions workflow.

Step Functions provides the serverless orchestration needed to track the multi-step order workflow, while DynamoDB stores the order state. Polling SQS introduces unnecessary delays, and using EC2 with EFS violates the serverless and low-operational-overhead requirements.

Answer: A,C,D. Ensure that the trust policy of the IAM roles created for the federated users or groups has set the SAML provider as principal. || Ensure that the appropriate IAM roles are mapped to company users and groups in the IdP's SAML assertions. || Ensure that the ARN of the SAML provider, the ARN of the created IAM role, and SAML assertion from the IdP are all included when the federated identity web portal calls the AWS STS AssumeRoleWithSAML API.

SAML federation requires mapping IdP groups to IAM roles, setting the SAML provider as the role principal, and passing all required ARNs to STS. Federated users do not need IAM policies directly attached, and VPC connectivity is irrelevant to browser-based SAML SSO.

Answer: C. Create a shared transit gateway. Have each spoke VPC connect to the transit gateway. In a central VPC, deploy a Gateway Load Balancer (GWLB) that fronts a fleet of firewall appliances with routing to the public internet.

AWS Transit Gateway connects thousands of VPCs without managing complex peering limitations. Deploying a Gateway Load Balancer in a central VPC lets you scale firewall appliances for centralized egress inspection. VPC peering fails here because strict connection limits prevent scaling to thousands of accounts.

Answer: B,E. As more customers are sending data, adjust the Write Capacity Unit (WCU) of the DynamoDB table to be able to accommodate all the write requests being processed by the Lambda functions. || Process the data in batches to avoid reaching the write limits to the DynamoDB table. Group the requests from API Gateway by streaming the data into an Amazon Kinesis data stream.

DynamoDB throws a provisioned throughput error when write capacity is exceeded, so increasing WCUs fixes that bottleneck. To prevent Lambda concurrency limits, stream API Gateway payloads into Kinesis, allowing Lambda to process data in resilient batches.

Answer: A. Combine an Elastic Load balancer in front of an Auto Scaling group of web servers with Amazon CloudFront for fast delivery. The web servers will first authenticate the users by logging into their social media accounts which are integrated in Amazon Cognito, then process the user's purchases and store them into an Amazon SQS queue using IAM Roles for Amazon EC2 Instances to gain permissions to the queue. Finally, the items from the queue are retrieved by a set of application servers and stored into an Amazon DynamoDB table.

CloudFront, a load balancer, and an Auto Scaling group handle sudden traffic spikes for the web tier. Decoupling the checkout process using an SQS queue buffers incoming requests, protecting the backend DynamoDB database during massive usage surges.

Answer: C,E. Check and configure the network ACL to allow communication between the two subnets. Ensure that the security groups allow the application host to talk to the database on the right port and protocol. || Use AWS Config to track historical changes to the security configurations associated to your instances.

Configuring security groups and network ACLs properly permits traffic between the application and database subnets. AWS Config is the designated service for tracking historical resource configuration changes, whereas Systems Manager handles operational tasks.

Answer: B. 1. Enable CloudTrail logging to required AWS resources. 2. Create an IAM user with read-only permissions to the required AWS resources. 3. Provide the access credential to the auditor.

AWS CloudTrail records API calls and account events for auditing. You grant external auditors access by creating an IAM user with read-only permissions to the CloudTrail S3 bucket. Option A fails because you manage audits directly without AWS intervention.

Answer: A,D. Take hourly database backups and export to an S3 bucket with transaction logs stored in S3 every 5 minutes. Set up a Cross-Region Replication (CRR) to another AWS Region. || Set up an AWS Backup plan for the Amazon RDS database with the continuous backups for point-in-time recovery (PITR) option enabled

AWS Backup with continuous backups enables point-in-time recovery to meet strict recovery objectives. Exporting hourly snapshots and transaction logs to S3 with cross-region replication provides offsite disaster recovery. Option B fails because Glacier retrieval times exceed the required time.

Answer: B. SSE-S3 provides strong multi-factor encryption in which each object is encrypted with a unique key. It also encrypts the key itself with a master key that it rotates regularly.

SSE-S3 provides strong encryption where Amazon S3 encrypts each object with a unique key and encrypts that key with a regularly rotated master key. A quick exam cue is that if you need to manage the keys yourself, you must choose SSE-KMS, not SSE-S3.

Answer: A,C. Create a new S3 bucket in US West (N. California) region and upload the files. Use S3 pre-signed URLs to ensure that only their client can access the files. Remove permission to use Amazon S3 URLs to read the files for anyone else. || Use CloudFront signed URLs to ensure that only their client can access the files. Create an origin access control (OAC) and give it permission to read the files in the bucket. Remove permission to use Amazon S3 URLs to read the files for anyone else.

Using S3 pre-signed URLs directly restricts file access, while using CloudFront signed URLs with an origin access control restricts content to CloudFront. Remember that signed cookies are better for multiple files, but do not secure direct S3 access without further restrictions.

Answer: D. Migrate the database to a cluster of EBS-backed Amazon EC2 instances across multiple AZs. Automate the creation of EBS snapshots from EBS volumes of the EC2 instance by using Amazon Data Lifecycle Manager. Install the SSM Agent to the EC2 instance and automate the patch management process using AWS Systems Manager Patch Manager.

Since Amazon RDS does not support Oracle Real Application Clusters, you must deploy the database on Amazon EC2. You can then use AWS Systems Manager Patch Manager to automate operating system updates and Amazon Data Lifecycle Manager for scheduled EBS snapshots.

Answer: C. The canonical name record (CNAME) is changed from the primary database to standby database.

During an Amazon RDS Multi-AZ failover, AWS automatically updates the DNS canonical name record to point to the standby instance. Applications seamlessly reconnect using the same endpoint without needing manual IP address reconfiguration.

Answer: A,C. Use AWS WAF to define customizable web security rules that control which traffic can access your web applications. || Use AWS Shield Advanced which provides enhanced DDoS attack detection and monitoring for application-layer traffic to your AWS resources.

AWS Shield Advanced provides managed DDoS protection and detailed attack notifications for network and transport layer threats. AWS WAF complements this by inspecting HTTP requests to block layer seven exploits like SQL injection.