What should a solutions architect do to ensure that all objects uploaded to an Amazon S3 bucket are encrypted?
Answer(s): D
S) D is correct because enforcing server-side encryption via an S3 bucket policy ensures all uploaded objects are encrypted at rest using SSE (e.g., AES-256 or AWS KMS). The policy denies PutObject requests lacking the x-amz-server-side-encryption header, guaranteeing encryption regardless of client behavior.A and B are incorrect because ACL handling does not guarantee encryption; they control access and object visibility, not encryption at rest. C is incorrect because enforcing secure transport (HTTPS) ensures in-transit security, not at-rest encryption of objects. Therefore, only D directly enforces SSE for all uploads.
A solutions architect is designing a multi-tier application for a company. The application's users upload images from a mobile device. The application generates a thumbnail of each image and returns a message to the user to confirm that the image was uploaded successfully.The thumbnail generation can take up to 60 seconds, but the company wants to provide a faster response time to its users to notify them that the original image was received. The solutions architect must design the application to asynchronously dispatch requests to the different application tiers.What should the solutions architect do to meet these requirements?
Answer(s): C
S) C) creates an asynchronous, durable decoupled workflow: images enqueue as messages, allowing thumbnail processing to occur independently while immediately informing the user that the image was received. SQS provides a reliable queue with at-least-once delivery and works well for decoupling the upload, processing, and notification steps.A) Incorrect: custom Lambda alone would couple processing to the user notification and may not scale or decouple reliably; 60-second processing could slow responses for user confirmation.B) Incorrect: Step Functions adds orchestration but is heavier for a simple queue-based decoupling; it isn’t as inherently asynchronous with durable queues as SQS.D) Incorrect: SNS topics with push notifications require additional processing to ensure thumbnail generation is complete before notifying the user; not as clean for decoupling the workflow.
A company’s facility has badge readers at every entrance throughout the building. When badges are scanned, the readers send a message over HTTPS to indicate who attempted to access that particular entrance.A solutions architect must design a system to process these messages from the sensors. The solution must be highly available, and the results must be made available for the company’s security team to analyze.Which system architecture should the solutions architect recommend?
Answer(s): B
The recommended serverless architecture with API Gateway invoking Lambda provides a scalable, highly available HTTPS endpoint for badge readers and durable storage in DynamoDB for fast queryable results, meeting HA and analysis needs without managing servers.A) EC2 endpoint introduces operational burden, potential single point of failure, and slower scale compared to Lambda for event-driven bursts.C) Route 53 is a DNS service, not an HTTP endpoint or event-driven processor; cannot directly process sensor payloads.D) VPC gateway endpoint to S3 with Site-to-Site VPN adds complexity and latency; S3 is for object storage, not for structured, queryable analysis and real-time processing.
A company wants to implement a disaster recovery plan for its primary on-premises file storage volume. The file storage volume is mounted from an Internet Small Computer Systems Interface (iSCSI) device on a local storage server. The file storage volume holds hundreds of terabytes (TB) of data.The company wants to ensure that end users retain immediate access to all file types from the on-premises systems without experiencing latency.Which solution will meet these requirements with the LEAST amount of change to the company's existing infrastructure?
A) The S3 File Gateway with VM cache would introduce latency for active on-prem users and requires changing access through NFS; it also relies on cloud egress for recovery, which violates “immediate access” requirement.B) Tape gateway is for archival backups, not for active file serving with low latency, and recovery involves restore from tape—not suitable for immediate access.C) Cached volume gateway reduces cloud reliance but still requires initial copy of all data to the gateway cache and relies on snapshot restores, which adds risk for immediate access during disaster.D) Volume Gateway stored volume preserves on-prem iSCSI access with local copy of the data, enabling immediate access and low latency; snapshots provide DR to EBS for rapid recovery with minimal changes to existing infrastructure.
A company is hosting a web application from an Amazon S3 bucket. The application uses Amazon Cognito as an identity provider to authenticate users and return a JSON Web Token (JWT) that provides access to protected resources that are stored in another S3 bucket.Upon deployment of the application, users report errors and are unable to access the protected content. A solutions architect must resolve this issue by providing proper permissions so that users can access the protected content.Which solution meets these requirements?
Answer(s): A
A) The correct approach is to have the Cognito identity pool assume an IAM role that grants access to the protected S3 resources. This uses temporary credentials issued by Cognito with the necessary permissions, aligning with IAM role-based access for authenticated users.B) S3 ACLs are not typically used with apps using Cognito/JWT for authorization and do not scale or align with per-user access control via identity pools.C) S3 eventually consistent reads are unlikely to cause user access errors in this scenario; deployment/read latency is not the root cause.D) Cognito identity pool custom attribute mappings do not grant access permissions; they map attributes, not authorization policies.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.