A media company uses Amazon CloudFront for its publicly available streaming video content. The company wants to secure the video content that is hosted in Amazon S3 by controlling who has access. Some of the company’s users are using a custom HTTP client that does not support cookies. Some of the company’s users are unable to change the hardcoded URLs that they are using for access.Which services or methods will meet these requirements with the LEAST impact to the users? (Choose two.)
Answer(s): A,B
Signed URLs and signed cookies provide time-limited access control for CloudFront delivered S3 content. Signed URLs work with clients that cannot handle cookies by embedding access parameters in the URL, while signed cookies protect requests from browsers or clients that do support cookies, enabling access control without changing hardcoded URLs. AWS AppSync is for API GraphQL/real-time data and not suitable for direct S3/CloudFront access control. JSON Web Token (JWT) is a token concept but not an AWS-native mechanism for CloudFront signed requests; it would require additional verification logic. AWS Secrets Manager stores credentials, not access control for delivery.
A company is preparing a new data platform that will ingest real-time streaming data from multiple sources. The company needs to transform the data before writing the data to Amazon S3. The company needs the ability to use SQL to query the transformed data.Which solutions will meet these requirements? (Choose two.)
A) Reason: Kinesis Data Streams for ingestion, Kinesis Data Analytics for SQL-based transformation, Kinesis Data Firehose to S3 delivery, and Athena to query S3 data aligns streaming ingest, in-stream transformation with SQL, durable S3 storage, and serverless SQL querying.B) Reason: MSK for streaming, Glue for ETL and S3 load, and Athena for SQL queries on S3 meets real-time ingestion via MSK, batch/ETL transformation with Glue, and SQL access via Athena.C) Incorrect: DMS is for migrations, not real-time streaming; EMR is heavier Hadoop/Spark-based; querying via Athena is fine only after S3, but flow isn’t optimal for streaming SQL transformation.D) Incorrect: RDS query editor cannot query data in S3; using MSK with Kinesis Data Analytics plus RDS editor is not standard or supported for S3-based querying.E) Incorrect: Uses RDS query editor for S3 data and combines Kinesis Data Streams with Glue but Firehose is redundant; not aligning with SQL query path on S3.
A company has an on-premises volume backup solution that has reached its end of life. The company wants to use AWS as part of a new backup solution and wants to maintain local access to all the data while it is backed up on AWS. The company wants to ensure that the data backed up on AWS is automatically and securely transferred.Which solution meets these requirements?
Answer(s): D
Amazon Storage Gateway with a stored volume gateway maintains data on-premises and asynchronously backs up a copy to AWS, ensuring local access to all data while securely transferring backups to the cloud.A) Snowball migrates data and provides a new endpoint; it does not support on-premises mounted access to actively backed-up data. B) Snowball Edge offers on-device storage and file interface, but Snowball Edge is not the standard solution for continuous backed-up access with on-premises mount points. C) Cached gateway stores a subset locally; not all data remains on-premises, so immediate local access to the entire dataset isn’t guaranteed. D) Stored volume gateway maps gateway volumes to on-premises storage, keeping data on-site for local access while backing up to AWS.
An application that is hosted on Amazon EC2 instances needs to access an Amazon S3 bucket. Traffic must not traverse the internet.How should a solutions architect configure access to meet these requirements?
Answer(s): B
A gateway VPC endpoint for S3 ensures that S3 traffic from the VPC remains on the AWS network and does not traverse the Internet. This is the correct mechanism to meet the requirement.A) Private hosted zone via Route 53 is for internal DNS resolution, not for ensuring private network paths to S3.C) NAT gateway would route traffic to the Internet for instances without public IPs, not ideal for S3 and still incurs egress via the Internet.D) Site-to-Site VPN connects networks, not directly to S3; it would add complexity and is unnecessary for S3 access within AWS.
An ecommerce company stores terabytes of customer data in the AWS Cloud. The data contains personally identifiable information (PII). The company wants to use the data in three applications. Only one of the applications needs to process the PII. The PII must be removed before the other two applications process the data.Which solution will meet these requirements with the LEAST operational overhead?
The correct choice is B because S3 Object Lambda can transform data on-the-fly to remove PII before the other two apps access it, minimizing data duplication and operational overhead while centralizing control over data masking.A is incorrect because a proxy layer increases complexity, adds maintenance burden, and does not inherently guarantee consistent PII removal across apps.C is incorrect due to data duplication across three buckets, increasing storage, synchronization, and governance overhead.D is incorrect for similar reasons to C and because DynamoDB is not ideal for large terabytes-scale data with multiple analytic access patterns and masking needs.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.