AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 9/12

Answer: B. Enable Amazon S3 Block Public Access in the S3 bucket.

Amazon S3 Block Public Access provides centralized controls that override policies to prevent public access with minimal configuration. Exam cue: for questions asking to secure S3 data effortlessly, Block Public Access almost always beats complex IAM policies or Config rules.

Answer: D. Create another Customer Gateway in a different data center and set up another dual-tunnel VPN connection.

Creating another Customer Gateway in a different data center provides redundancy for the on-premises VPN endpoint, ensuring fault tolerance. Exam cue: a virtual private gateway is already highly available across Availability Zones, so focus on the customer side for redundancy.

Answer: C. Create an Amazon DynamoDB global table to store the semi-structured data in two Regions. Use on-demand capacity mode to allow DynamoDB scaling. Run the web service on an Auto Scaling Amazon ECS Fargate cluster in each region. Place each Fargate cluster behind its own Application Load Balancer (ALB). Create Amazon Route 53 Alias records pointed to each ALB using a latency routing policy with health checks enabled.

DynamoDB global tables provide multi-active read and write replication across regions, and on-demand capacity handles sudden load spikes automatically. Fargate allows rapid container scaling, and Route 53 latency routing ensures users hit the fastest healthy regional endpoint.

Answer: D. Set up a DynamoDB stream to detect the new entries and automatically trigger the Lambda function.

DynamoDB Streams capture item-level modifications, providing a native event source to trigger your Lambda function automatically. This requires minimal configuration compared to complex alternatives like migrating databases or building SNS fan-out architectures.

Answer: C. Migrate the database from the Amazon EC2 instance to an Amazon Aurora global database. Set the us-east-1 region as the primary database and the us-west-2 region as the secondary database. Configure Amazon Route 53 DNS entry with health checks and failover routing policy to the us-west-2 region.

Amazon Aurora Global Database provides storage-based replication with typical cross-region latency under one second, meeting strict recovery objectives. Route 53 failover routing shifts traffic to the secondary region during a disaster.

Answer: B. Reconfigure the existing web servers to publish messages to a standard queue on Amazon SQS. Create an Auto Scaling group of Amazon EC2 instances that will pull requests from the queue and process the media files. Configure the Auto Scaling group to scale based on the length of the SQS queue. Send the processed media files to an Amazon S3 bucket.

An Auto Scaling group of EC2 instances scales based on SQS queue depth, handling the bursty workload effectively. AWS Lambda is incorrect here because its 15-minute maximum execution timeout cannot support the 30-minute processing requirement.

Answer: C. Configure the CloudFront distribution to redirect HTTP to HTTPS protocol. Generate a new SSL certificate on AWS Certificate Manager and use it as the CloudFront distribution and origin certificate.

Using an AWS Certificate Manager certificate on both CloudFront and the Application Load Balancer origin provides seamless end-to-end encryption. Configuring the distribution to redirect HTTP to HTTPS guarantees viewer connections are secured. CloudFront default certificates cannot serve custom domain names.

Answer: C,E. Configure CloudFront to use its default SSL/TLS certificate by changing the Viewer Protocol Policy setting for one or more cache behaviors to require HTTPS communication. || Set the Viewer Protocol Policy< to use Redirect HTTP to HTTPS or HTTPS Only.

When using the default CloudFront domain name, you can enforce viewer-side HTTPS by configuring the Viewer Protocol Policy to Redirect HTTP to HTTPS or HTTPS Only. In this specific configuration, CloudFront automatically provides and uses its default SSL certificate.

Answer: A. Configure authorization to use AWS_IAM for the API Gateway method. Create the IAM users or roles that have the execute-api:Invoke permission to the ARN of the API resource. Enable request signing with AWS Signature for every call to the API endpoint. Trace and analyze each user request on API Gateway by using AWS X-Ray.

Configuring AWS_IAM authorization on the API Gateway method ensures only validated identities can invoke the endpoint. AWS X-Ray is the correct tool here because it specifically traces requests end-to-end and generates service maps, whereas CloudWatch Logs only captures operational metrics.

Answer: B. Create an Amazon S3 bucket with website hosting enabled and upload the game package on it. Create an Amazon CloudFront distribution with the S3 bucket as the origin. Create an Amazon Route 53 entry pointing to the CloudFront distribution. Publish the Route 53 entry as the download URL to allow users to download the game package.

Serving the package through CloudFront with an S3 origin provides a highly cost-effective, globally distributed caching layer for massive download spikes. Using Requestor Pays is a strong distractor, but it requires users to have their own AWS accounts, which ruins the public experience.

Answer: B. Increase the capacity and scaling thresholds of the Auto Scaling group to allow the application servers to scale up across all Availability Zones, which will lower the aggregate utilization of the EC2 instances. Use Reserved Instances to handle the steady-state load and a combination of On-Demand and Spot Instances to process the peak load. When the peak usage is over, scale down the number of the On-Demand and Spot instances.

Configuring diverse Auto Scaling policies across multiple Availability Zones ensures your application dynamically scales to handle unexpected regional failures. Blending Reserved Instances for the baseline with On-Demand and Spot capacity for peak traffic provides the optimal cost-effective architecture.

Answer: D. Provision an AWS Storage Gateway – file gateway appliance on the on-premises data center. Configure the MAM solution to extract the video files from the current tape archives and move them to the file gateway share which is then synced to Amazon S3. Use Amazon Rekognition to build a collection based on the videos by using the catalog of people's faces and names. Create an AWS Lambda function that will invoke Rekognition to pull the video files from the S3 bucket, retrieve the generated metadata and then push it to the MAM solution search catalog.

A file gateway seamlessly syncs the tape archives to S3 via standard protocols with minimal operational overhead. Amazon Rekognition then processes the videos directly to extract metadata without custom machine learning infrastructure.

Answer: D. Set up a CloudFront distribution to cache objects from a custom origin to offload traffic from your on-premises environment. Customize your object cache behavior, and choose a time-to-live that will determine how long objects will reside in the cache.

Amazon CloudFront caches content at edge locations, offloading unexpected traffic bursts from on-premises servers without complex migrations. Practical cue: when dealing with unpredictable on-premises bursts and tight timelines, leverage a content delivery network to absorb the load.

Answer: C. Add read replicas for the RDS database to speed up batch analytics and use Amazon SNS to notify the on-premises system to update the dashboard.

Adding Amazon RDS Read Replicas offloads the heavy batch analytics reads, freeing up the primary database for CRM traffic. Amazon SNS provides a push mechanism to trigger the SMTP email notification, whereas SQS requires polling to automate updates.

Answer: A. Use AWS Systems Manager Patch Manager to deploy the OS security patches on the EC2 instances. Use AWS Config to manage, detect and record the security compliance of the EC2 instances.

Systems Manager Patch Manager automates operating system patch deployments, while AWS Config continuously records configurations to track patch compliance. State Manager handles desired state configurations but lacks the dedicated patching baseline features required here.

Answer: C,E. Schedule a daily snapshot of the Amazon EC2 instances for the web and application tier. Copy the snapshot to the backup region. Restore the backups in case of a disaster in the primary region. || Set up a cross-Region read replica of the Amazon Aurora database to the backup region. Promote this read replica as the master database in case of a disaster in the primary region.

Copying EC2 snapshots to the backup region provides a cost-effective pilot light recovery for stateless tiers within the thirty minute recovery objective. Aurora cross-region read replicas meet the strict five minute recovery point objective by asynchronously replicating data continuously.