An Amazon EC2 instance is located in a private subnet in a new VPC. This subnet does not have outbound internet access, but the EC2 instance needs the ability to download monthly security updates from an outside vendor.What should a solutions architect do to meet these requirements?
Answer(s): B
A NAT gateway in a public subnet allows resources in a private subnet to access the internet for updates without exposing them directly. It provides scalable, managed outbound internet access with high availability.A) Incorrect: An internet gateway attached to the VPC with a private subnet default route would not work unless the private subnet has a route through a NAT or an internet-accessible instance; private subnets cannot reach the internet directly.C) Incorrect: A NAT instance in the same private subnet would break isolation and require a public-facing resource in the same subnet; also scaling and maintenance concerns arise.D) Incorrect: An internet gateway alone does not enable outbound traffic from a private subnet; NAT functionality is required.
A solutions architect needs to design a system to store client case files. The files are core company assets and are important. The number of files will grow over time.The files must be simultaneously accessible from multiple application servers that run on Amazon EC2 instances. The solution must have built-in redundancy.Which solution meets these requirements?
Answer(s): A
The correct choice is A) because Amazon EFS provides a scalable, shared file system accessible concurrently by multiple EC2 instances with built-in redundancy and high availability, suitable for storing core assets that grow over time. EBS is block storage attached to a single instance (not shared) and lacks multi-attach support for many instances. S3 Glacier Deep Archive is archival storage with retrieval delays and not suitable for active, concurrent file access. AWS Backup is a backup service, not a primary storage solution for concurrent file access across EC2 instances.
A solutions architect has created two IAM policies: Policy1 and Policy2. Both policies are attached to an IAM group.A cloud engineer is added as an IAM user to the IAM group. Which action will the cloud engineer be able to perform?
Answer(s): C
The correct answer is C because both policies attached to the group grant permissions to manage EC2 instances, and adding the user via the group inherits those permissions.A) Deleting IAM users is restricted to IAM admins with specific IAM policies; group policies here do not grant user-management rights unless explicitly allowed.B) Deleting directories is not an AWS service action; there is no IAM action for “deleting directories” in standard AWS IAM.D) Deleting CloudWatch Logs requires specific logs:DeleteLogGroup or related permissions; absence of such permissions in the policies would prevent this.
A company is reviewing a recent migration of a three-tier application to a VPC. The security team discovers that the principle of least privilege is not being applied to Amazon EC2 security group ingress and egress rules between the application tiers.What should a solutions architect do to correct this issue?
The correct answer is B.A) Using the security group ID as the source/destination enforces that only traffic between the defined groups is allowed, aligning with least privilege by not permitting broad CIDR ranges.C) Using VPC CIDR blocks would allow traffic from any instance in the VPC, violating least privilege.D) Subnet CIDR blocks also permit traffic from all instances within those subnets, not just the intended peers.A) Using instance IDs is invalid for security group rules and does not apply to typical cross-tier communication; security groups reference other groups, not individual instances.
A company has an ecommerce checkout workflow that writes an order to a database and calls a service to process the payment. Users are experiencing timeouts during the checkout process. When users resubmit the checkout form, multiple unique orders are created for the same desired transaction.How should a solutions architect refactor this workflow to prevent the creation of multiple orders?
Answer(s): D
The correct answer is D. Using a database-stored order with an SQS FIFO queue ensures exactly-once processing and preserves order for the payment service; the consumer deletes the message after successful processing, preventing duplicate charges from retries.A) Kinesis Data Firehose is for streaming data delivery, not reliable exactly-once processing of discrete order events; multiple retried reads could duplicate.B) CloudTrail-based Lambda is reactive to admin/audit events, not tied to user checkout idempotency; potential duplicates remain without strong deduplication.C) SNS is a pub/sub bus without guaranteed exactly-once delivery or message queuing semantics; polls can lead to duplicates and out-of-order handling.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.