A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company's chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use of physical backup tapes. The company must preserve the existing investment in the on-premises backup applications and workflows.What should a solutions architect recommend?
Answer(s): D
AWS Storage Gateway with iSCSI-VTL mirrors on-premises backup tapes to a cloud tier, allowing existing backup applications and workflows to run without physical tapes while preserving investment. A) NFS gateway would not provide VTL compatibility for traditional backup software. B) EFS via NFS does not emulate tape libraries or integrate with legacy backup workflows that expect VTL. C) EFS with iSCSI is not supported; EFS supports NFS, not iSCSI, and lacks VTL integration. D) Correct: Storage Gateway VTL interface preserves on-prem backup processes and leverages cloud storage for tape replacement.
A company has data collection sensors at different locations. The data collection sensors stream a high volume of data to the company. The company wants to design a platform on AWS to ingest and process high-volume streaming data. The solution must be scalable and support data collection in near real time. The company must store the data in Amazon S3 for future reporting.Which solution will meet these requirements with the LEAST operational overhead?
Answer(s): A
Kinesis Data Firehose is a fully managed, near real-time streaming delivery service that directly buffers, aggregates, and writes data to S3 with automatic scaling and minimal operational overhead, making it ideal for high-volume ingestion with no server management.A) Correct: Firehose handles end-to-end streaming to S3 with automatic scaling and batching, reducing ops.B) Glue is primarily for ETL batch or micro-batch workloads; streaming support exists but requires more setup and is not as turnkey for high-volume real-time ingestion to S3.C) Lambda alone is event-driven but would require managing shards/throughput and more infrastructure to sustain high-volume streaming to S3.D) DMS is for database migrations and streaming replication, not suitable for general sensor data ingestion to S3.
A company has separate AWS accounts for its finance, data analytics, and development departments. Because of costs and security concerns, the company wants to control which services each AWS account can use.Which solution will meet these requirements with the LEAST operational overhead?
Answer(s): B
A concise justification: B is correct because SCPs attached to OUs in AWS Organizations centrally restrict allowed AWS services per department with minimal ongoing effort and scalable governance. A) Systems Manager templates are not designed to restrict service usage; they automate configurations, not access controls. C) CloudFormation provisions resources but does not enforce per-department service usage at the governance level. D) Service Catalog controls which products are deployable, not arbitrary AWS services; it adds management overhead and may not cover all services. Thus B provides least operational overhead with proper centralized control.
A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier in the public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets. The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third-party provider. A solutions architect must devise a strategy that maximizes security without increasing operational overhead.What should the solutions architect do to meet these requirements?
A) Deploy a NAT instance in the VPC. Route all the internet-based traffic through the NAT instance.B) Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway.C) Configure an internet gateway and attach it to the VPC. Modify the private subnet route table to direct internet-bound traffic to the internet gateway.D) Configure a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.B enables scalable, managed NAT for private subnets, reducing operational overhead and securing outbound internet access. NAT gateways are designed for private subnets and support VPC routing to internet-bound traffic without exposing instances. A NAT instance (A) requires patching, scaling, and maintenance. C is incorrect because private subnets should not have direct internet access via an Internet Gateway. D is for VPN/IPsec connections, not needed for standard outbound internet traffic.
A company is using AWS Key Management Service (AWS KMS) keys to encrypt AWS Lambda environment variables. A solutions architect needs to ensure that the required permissions are in place to decrypt and use the environment variables.Which steps must the solutions architect take to implement the correct permissions? (Choose two.)
Answer(s): B,D
The Lambda execution role must have KMS decrypt permissions to access the encrypted environment variables, and the KMS key policy must allow the Lambda execution role to use the key. Therefore B and D are correct.A is incorrect because Lambda resource policies aren’t the mechanism to grant KMS decrypt for environment variables. C is incorrect since “Lambda function policy” is not a recognized place to grant KMS usage; KMS permissions are governed by the key policy and IAM policies. E is incorrect because the Lambda resource policy is not the entity that interacts with the KMS key policy; the key policy must explicitly allow the Lambda role.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.