A company runs an application on a group of Amazon Linux EC2 instances. For compliance reasons, the company must retain all application log files for 7 years. The log files will be analyzed by a reporting tool that must be able to access all the files concurrently.Which storage solution meets these requirements MOST cost-effectively?
Answer(s): D
Amazon S3 provides cost-effective, durable object storage with lifecycle policies and concurrent multi-user access, ideal for long-term log retention at scale. It supports 7-year retention via lifecycle rules (glacier/standard transitions) and can be accessed concurrently by multiple analysis tools without mounting, unlike block or instance-store options.A) EBS is block storage tied to a single EC2 instance and does not scale across instances or provide long-term cost-effective archival for logs.B) EFS offers shared file storage but is more expensive for large, long-term retention and higher throughput costs than S3 for immutable logs.C) EC2 instance store is ephemeral and loss-prone; data is not persisted after stop or terminate and is unsuitable for long-term retention.D) Correct: S3 fits durability, cost, concurrency, and lifecycle needs.
A company has hired an external vendor to perform work in the company’s AWS account. The vendor uses an automated tool that is hosted in an AWS account that the vendor owns. The vendor does not have IAM access to the company’s AWS account.How should a solutions architect grant this access to the vendor?
Answer(s): A
A) Creating an IAM role in the company’s account and allowing the vendor’s external account to assume it is the correct approach. It uses cross-account access via STS AssumeRole, granting least-privilege permissions without sharing credentials. The vendor’s tools can assume the role from their account to perform required actions.B) Not suitable because sharing a password and creating a user in the company’s account would require long-term credentials and violates best practices for cross-account access and vendor isolation.C) Not valid because you cannot add an external account’s IAM user to a group in the company’s account; cross-account trust is needed.D) Not appropriate because creating an identity provider for the vendor’s account implies a federation setup, but the standard pattern for cross-account tool access is a role in the company account assumed by the vendor.
A company has deployed a Java Spring Boot application as a pod that runs on Amazon Elastic Kubernetes Service (Amazon EKS) in private subnets. The application needs to write data to an Amazon DynamoDB table. A solutions architect must ensure that the application can interact with the DynamoDB table without exposing traffic to the internet.Which combination of steps should the solutions architect take to accomplish this goal? (Choose two.)
Answer(s): A,D
An IAM role attached to the EKS pod provides the necessary permissions for the application to access DynamoDB without embedding credentials, and a VPC endpoint for DynamoDB ensures traffic remains entirely within the AWS network, avoiding internet exposure.A) Correct: Using a Kubernetes service account with an IAM role (IRSA) grants pod-level permissions to DynamoDB securely.D) Correct: DynamoDB VPC endpoint (Gateway) allows private, scalable, and isolated access to DynamoDB from the VPC.B) Incorrect: An IAM user is not associated with the pod; long-term credentials would be exposed if used by code.C) Incorrect: NACLs are stateless and do not control egress to DynamoDB; they don’t provide secure, private connectivity.E) Incorrect: Embedding access keys in code is insecure and violates best practices.
A company recently migrated its web application to AWS by rehosting the application on Amazon EC2 instances in a single AWS Region. The company wants to redesign its application architecture to be highly available and fault tolerant. Traffic must reach all running EC2 instances randomly.Which combination of steps should the company take to meet these requirements? (Choose two.)
Answer(s): C,E
C) Multivalue answer routing distributes traffic across healthy endpoints, allowing random distribution among multiple EC2 instances and enabling HA by routing to any healthy instance.E) Four EC2 instances across two Availability Zones (2 per AZ) provides fault tolerance (AZ failure isolation) and higher availability, ensuring traffic can be served from surviving instances in either AZ.A) Route 53 failover routing is for active/passive primary/secondary; not suitable for random distribution.B) Weighted routing can influence distribution but not ensure random, and requires explicit weights; not ideal for HA across AZs.D) Two and one instance offers insufficient capacity and AZ diversity for tolerating AZ-level failures.
A media company collects and analyzes user activity data on premises. The company wants to migrate this capability to AWS. The user activity data store will continue to grow and will be petabytes in size. The company needs to build a highly available data ingestion solution that facilitates on-demand analytics of existing data and new data with SQL.Which solution will meet these requirements with the LEAST operational overhead?
Answer(s): B
Kinesis Data Firehose delivering to Redshift meets scalable ingestion, high availability, and on-demand SQL analytics with minimal ops.A) Kinesis data stream to S3 requires self-managed analytics layer for SQL; more operational overhead than Firehose-Redshift integration.C) S3 with Lambda is serverless but adds separate analytics layer and is not a managed SQL data warehouse; less suitable for on-demand SQL analytics at petabyte scale.D) Custom EC2 ingestion to RDS Multi-AZ involves significant operational burden and does not scale as easily as a managed data warehouse for petabytes.B) Managed, scalable ingestion via Firehose into Redshift minimizes admin tasks and enables SQL-based analytics with high availability.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.