AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 8/8

Answer: C. Configure Amazon API Gateway with the required resources and methods. Create unique Lambda functions to process each resource and configure the API Gateway methods with proxy integration to the respective Lambda functions. Control user access to the API by using Amazon Cognito user pools. Store service object metadata in an Amazon DynamoDB table with Auto Scaling enabled. Create a secured Amazon S3 bucket to store the static content. Generate presigned URLs when referencing objects stored on the S3 bucket.

API Gateway with Lambda proxy integration provides a serverless REST API, and Cognito user pools handle authentication without custom code. Fargate incurs higher baseline costs than Lambda, and custom authorizers add unnecessary operational overhead compared to managed pools.

Answer: B. Use AWS Systems Manager Patch Manager to manage and deploy the security patches of your EC2 instances based on the patch baselines from your on-premises data center. Install the SSM Agent to all of your instances and automate the patching schedule by using AWS Systems Manager Maintenance Windows.

Patch Manager automates OS patching using custom baselines, while Maintenance Windows schedule these disruptive tasks safely. Session Manager only provides shell access, and writing custom Lambda scripts to run commands requires unnecessary operational overhead.

Answer: A. Configure an IAM policy that authorizes access to the certificate store only for the cybersecurity team and then add a configuration to terminate the SSL on the ELB.

Configuring IAM policies restricts access to the ACM certificates, while ELB SSL termination ensures private keys never touch EC2 instances. Uploading certificates to S3 is insecure, and SCPs only set guardrails without granting actual resource access permissions.

Answer: A. Configure a Challenge-Handshake Authentication Protocol (CHAP) to authenticate iSCSI and initiator connections.

Configuring Challenge-Handshake Authentication Protocol secures iSCSI connections by periodically verifying the initiator identity, preventing replay attacks. CHAP does not apply to NFS connections, and changing gateway types does not resolve underlying protocol vulnerabilities.

Answer: B. Set up an architecture where the mobile app will send the user's location to an Amazon SQS queue, and a fleet of On-Demand Amazon EC2 instances will retrieve the relevant offers from an Amazon DynamoDB table. Once the data has been processed, use AWS SNS Mobile Push to send out the offers to the mobile app.

Amazon SNS Mobile Push delivers messages directly to mobile endpoints, making it ideal for sending timely real estate alerts globally. AWS Device Farm is strictly for testing, and relational databases like RDS or Aurora lack the necessary scalability for global user profiles.

Answer: B,C. Authenticate against LDAP using an identity broker you created, and have it call IAM Security Token Service (STS) to retrieve IAM federated user credentials. The application then gets the IAM federated user credentials from the identity broker to access the appropriate S3 bucket. || The application first authenticates against LDAP to retrieve the name of an IAM role associated with the user. It then assumes that role via a call to IAM Security Token Service (STS). Afterward, the application can now use the temporary credentials from the role to access the appropriate S3 bucket.

Authenticating users against LDAP and using an identity broker to assume IAM roles via STS securely grants temporary S3 access. You cannot use LDAP credentials to log in to IAM directly, and Direct Connect modifications do not resolve application-level authentication requirements.

Answer: A. Register the IoT devices to AWS IoT Device Management and monitor the devices' health and ensure the devices are connected to AWS IoT Core.

AWS IoT Device Management allows administrators to register, organize, monitor, and remotely manage IoT devices at scale to troubleshoot connectivity. Device Defender is strictly for security audits and anomaly detection, meaning it will not help you diagnose fleet health or resolve interrupted connections.

Answer: D. Store all recordings in an Amazon S3 bucket. Create an S3 lifecycle policy to move objects older than 90 days to Amazon S3 Glacier. Create an AWS Lambda trigger to start a transcription job using Amazon Transcribe. Update the web portal so it can be hosted on an Amazon S3 bucket, Amazon API Gateway, and AWS Lambda.

Storing files in Amazon S3 with a lifecycle policy to Glacier directly satisfies the cheap long-term storage requirement. Using Lambda to trigger Amazon Transcribe automates speech-to-text processing, avoiding unnecessary EC2 fleets. Distractors incorrectly suggest AWS IQ for automation or Amazon Translate, which only handles text translation, not audio.

Answer: D. Migrate the database using the AWS Database Migration Service and use a Cold HDD (sc1) EBS volume.

Cold HDD volumes provide low-cost magnetic storage that defines performance in terms of throughput rather than IOPS. This makes them the ideal choice for infrequently accessed, throughput-oriented workloads. Throughput Optimized HDD is for frequently accessed data, making it a less cost-effective distractor here.

Answer: A. You can use one S3 source bucket that is partitioned according to the month a blog entry was submitted, and store the entry in that partition. Create a CloudFront distribution with access permissions to S3 and is restricted only to it.

Partitioning data by upload month in a single S3 bucket allows you to easily apply different cache behaviors based on object age. Restricting an Origin Access Identity to the bucket ensures secure access. Duplicating data or forcing minimum TTLs is inefficient.

Answer: C. Create an Oracle database in Amazon RDS with Multi-AZ deployments.

Amazon RDS Multi-AZ deployments provide high availability by synchronously replicating data to a standby instance in a different Availability Zone. Read Replicas fail this requirement because content writers cannot upload to the database if the primary node goes down.

Answer: D. On the backup region, create a scaled-down version of the fully functional environment with one Amazon EC2 instance of the web server and application server in their own Auto Scaling groups behind Application Load Balancers. Create a standby database instance that replicates data from the primary database. In case of disaster, scale the instances to meet the demand and update the Amazon Route 53 record to point to the backup region.

A warm standby disaster recovery strategy uses a scaled-down but fully functional replica of the primary environment to meet tight recovery time objectives. This approach satisfies the five-minute failover requirement while avoiding the high continuous costs of a fully redundant multi-site active-active deployment.

Answer: D. Configure a reserved concurrency limit for the new function to ensure that its executions will not exceed this limit. Use Amazon CloudWatch alarms to monitor the Throttles metric for Lambda functions to ensure that the concurrency limit is not being reached.

Configuring reserved concurrency caps the maximum concurrent executions for this specific function, guaranteeing capacity remains available for critical workloads. Backoff algorithms or timeouts still consume invocation slots, and moving to a separate account introduces unnecessary operational overhead.

Answer: E. Use AWS CloudFormation to manage the cloud architecture and Amazon CloudFront as the CDN.

CloudFormation is the recommended service for managing AWS infrastructure as code, enabling safe rollback and environment staging. CloudFront is the correct global content delivery network service, whereas CloudWatch is strictly a monitoring and observability platform.

Answer: C. 3. Use an AWS CloudHSM instance to perform the SSL transactions.

Configuring TCP load balancing on the ELB passes SSL traffic directly to AWS CloudHSM, keeping private keys secure in dedicated hardware. For the exam, remember that S3 is an insecure place to store private keys and CloudHSM provides FIPS-compliant hardware protection.

Answer: C. Configure an Auto Scaling group and attach it to the NLB. Set the minimum capacity to 5 instances and the maximum capacity to 30. Purchase Reserved Instances for 5 instances.

An Auto Scaling group attached to the load balancer dynamically adjusts capacity to handle performance spikes while keeping baseline costs low. Purchasing Reserved Instances for the baseline capacity ensures long-term cost optimization compared to paying strictly On-Demand rates.

Answer: D. On VPC-A, add a static route for VPC-B CIDR (10.0.0.77/32) with the target pcx-aaaabbbb and another static route for VPC-C CIDR (10.0.0.0/16) with the target pcx-aaaacccc. On VPC-B, add a static route for VPC-A CIDR (172.16.0.0/16) with the target pcx-aaaabbbb. On VPC-C, add a static route for VPC-A CIDR (172.16.0.0/16) with the target pcx-aaaacccc.

Using a /32 static route in VPC-A leverages the longest prefix match to direct traffic to the specific database instance in VPC-B. The broader /16 route safely handles all other overlapping traffic by sending it to VPC-C. Distractors fail because network ACLs cannot redirect traffic.