An application runs on an Amazon EC2 instance that has an Elastic IP address in VPC A. The application requires access to a database in VPC B. Both VPCs are in the same AWS account.Which solution will provide the required access MOST securely?
Answer(s): B
A strong secure design is to use a VPC peering connection between VPC A and VPC B to enable private, routing-based access to the DB without exposing traffic to the public internet.A) Incorrect: Allowing all traffic from the public IP is insecure and bypasses the private networking model; it also depends on the public IP consistency and public exposure.C) Incorrect: Making the DB publicly accessible introduces exposure to the Internet and increases risk; public IPs on DB instances are discouraged.D) Incorrect: Proxies traffic through an EC2 in VPC B adds complexity and single point of failure; not as secure as private peering.B) Correct: Private, scalable connectivity using VPC peering maintains data within the AWS network and uses existing security groups and NACLs.
A company runs demonstration environments for its customers on Amazon EC2 instances. Each environment is isolated in its own VPC. The company’s operations team needs to be notified when RDP or SSH access to an environment has been established.
Answer(s): C
Rationale: C is correct because VPC flow logs capture network traffic to/from EC2; by exporting to CloudWatch Logs and configuring metric filters and alarms, you can notify when RDP/SSH access activity occurs, meeting the requirement to alert on access establishment.A) CloudWatch Application Insights monitors app health, not per-connection access; it won’t reliably detect RDP/SSH access events.B) IAM role with AmazonSSMManagedInstanceCore enables AWS Systems Manager to manage instances, not to alert on access events.D) EventBridge EC2 state-change events indicate instance lifecycle changes, not ongoing access activity; subscribers would not reflect established RDP/SSH sessions.
A solutions architect has created a new AWS account and must secure AWS account root user access.Which combination of actions will accomplish this? (Choose two.)
Answer(s): A,B
The correct actions are A and B because strong password and multi-factor authentication (MFA) protect root account access and prevent unauthorized use, aligning with AWS best practices for securing the root user. A is correct because a strong password reduces guessing risk. B is correct because MFA adds a second authentication factor, mitigating compromise even if password is known.C is incorrect because storing access keys for the root user is risky and not supported; root users should not have access keys. D is incorrect because you cannot add the root user to an IAM group; root is a separate identity with full access. E is incorrect because policies cannot grant root-level permissions to itself via inline policy; root access is inherent and not governed by IAM policies.
A company is building a new web-based customer relationship management application. The application will use several Amazon EC2 instances that are backed by Amazon Elastic Block Store (Amazon EBS) volumes behind an Application Load Balancer (ALB). The application will also use an Amazon Aurora database. All data for the application must be encrypted at rest and in transit.Which solution will meet these requirements?
Amazon EBS volumes and Aurora storage must be encrypted at rest with AWS KMS; data in transit must be encrypted with TLS coming from an ACM-managed certificate on the ALB. Option C correctly uses KMS for at-rest encryption of EBS and Aurora and ACM certificate on the ALB for TLS in transit. A is wrong because ACM certificates encrypt at rest vs TLS in transit and ACM cannot encrypt EBS/Aurora storage; certificates alone don’t encrypt EBS/Aurora. B is incorrect because root account usage and account-wide encryption toggles do not provide per-resource encryption methods. D incorrectly proposes BitLocker (a Windows on-prem tool) and importing TLS keys to KMS, which is not supported for ALB TLS termination.
A company is moving its on-premises Oracle database to Amazon Aurora PostgreSQL. The database has several applications that write to the same tables. The applications need to be migrated one by one with a month in between each migration. Management has expressed concerns that the database has a high number of reads and writes. The data must be kept in sync across both databases throughout the migration.What should a solutions architect recommend?
AWS Schema Conversion Tool (SCT) helps convert Oracle schema to PostgreSQL-compatible schema, which is essential for Aurora PostgreSQL compatibility, and AWS DMS handles ongoing replication with full load plus CDC to keep data in sync during cutovers. A memory-optimized replication instance provides adequate caching for high CDC throughput and complex transformations without incurring excessive latency, fitting a scenario with ongoing reads/writes during migration.A) DMS CDC alone lacks initial schema conversion, risking schema drift.B) Full load plus CDC is correct for ongoing sync, but without SCT, schema mismatches may fail migrations.D) Compute-optimized instance focuses on CPU, not necessarily memory/cache needs for large, concurrent CDC; larger tables require more throughput than just CPU.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.