A company hosts a three-tier web application that includes a PostgreSQL database. The database stores the metadata from documents. The company searches the metadata for key terms to retrieve documents that the company reviews in a report each month. The documents are stored in Amazon S3. The documents are usually written only once, but they are updated frequently.The reporting process takes a few hours with the use of relational queries. The reporting process must not prevent any document modifications or the addition of new documents. A solutions architect needs to implement a solution to speed up the reporting process.Which solution will meet these requirements with the LEAST amount of change to the application code?
Answer(s): B
The correct answer is B.A) DocumentDB read replicas would add unnecessary complexity and latency; PostgreSQL query workloads on the primary are already heavy—DocumentDB isn’t needed for relational workloads.C) RDS Multi-AZ provides failover and read performance benefits via a synchronous standby, not a dedicated read replica; using the secondary would still be constrained and may not meet reporting performance without application changes.D) DynamoDB is not suitable for relational SQL queries or joining metadata; fixed write capacity and eventual consistency would hinder report performance and scalability for complex queries.B) Aurora PostgreSQL with a read replica offers fast, scalable read scaling for heavy reporting queries with minimal application changes.
A company has a three-tier application on AWS that ingests sensor data from its users’ devices. The traffic flows through a Network Load Balancer (NLB), then to Amazon EC2 instances for the web tier, and finally to EC2 instances for the application tier. The application tier makes calls to a database.What should a solutions architect do to improve the security of the data in transit?
Answer(s): A
A) The TLS listener with the server certificate on the NLB ensures encryption in transit from clients to the load balancer and between the load balancer and backend instances, meeting data-in-transit protection.B) AWS Shield Advanced and WAF protect against DDoS and web exploits, not primarily encrypting data in transit.C) ALB with WAF improves application-layer security but the current NLB path already handles high-throughput TLS; switching does not inherently enhance in-transit encryption and NLB supports TLS.D) Encrypting EBS at rest protects data at rest, not in transit.
A company is planning to migrate a commercial off-the-shelf application from its on-premises data center to AWS. The software has a software licensing model using sockets and cores with predictable capacity and uptime requirements. The company wants to use its existing licenses, which were purchased earlier this year.Which Amazon EC2 pricing option is the MOST cost-effective?
Dedicated Reserved Hosts are the most cost-effective option when you have existing socket/cores licenses and want to bring-your-own-license (BYOL) compliance, as they align with license terms tied to physical host resources and allow long-term reservations without paying per-instance compute charges. A) Correct: Reserved Hosts provide capacity with BYOL and sustained usage, reducing cost versus on-demand. B) Dedicated On-Demand Hosts is not cost-optimal for predictable capacity and does not leverage reserved pricing. C) Dedicated Reserved Instances are not a real AWS term; RI concept applies to instances, not hosts, and would not accommodate BYOL licensing on physical hosts. D) Dedicated On-Demand Instances incur ongoing compute charges without license optimization.
A company runs an application on Amazon EC2 Linux instances across multiple Availability Zones. The application needs a storage layer that is highly available and Portable Operating System Interface (POSIX)-compliant. The storage layer must provide maximum data durability and must be shareable across the EC2 instances. The data in the storage layer will be accessed frequently for the first 30 days and will be accessed infrequently after that time.Which solution will meet these requirements MOST cost-effectively?
Answer(s): C
EFS provides a POSIX-compliant, highly available, shareable block-level filesystem across multiple AZs with Durability. The Standard storage class supports frequent access, and a lifecycle policy can move data to EFS Standard-Infrequent Access for cost savings while preserving POSIX semantics and shared access.A) S3 Standard with Glacier move reduces access capability and not POSIX file system; not shared as a mounted filesystem.B) S3 Standard-IA is object storage, not POSIX-compliant file system or mounted filesystem.D) EFS One Zone-IA sacrifices multi-AZ durability and availability, not aligned with cross-AZ EC2 access.
A solutions architect is creating a new VPC design. There are two public subnets for the load balancer, two private subnets for web servers, and two private subnets for MySQL. The web servers use only HTTPS. The solutions architect has already created a security group for the load balancer allowing port 443 from 0.0.0.0/0. Company policy requires that each resource has the least access required to still be able to perform its tasks.Which additional configuration strategy should the solutions architect use to meet these requirements?
The correct strategy uses security groups to enforce least privilege between tiers, since they are stateful and designed for instances. C) grants web servers access to 443 only from the load balancer’s traffic and restricts MySQL to 3306 from the web servers, aligning with least access principles and reducing exposure. A) uses 0.0.0.0/0 to web servers and 3306 from web servers SG, increasing risk and not least privilege. B) and D) rely on network ACLs, which are stateless and add complexity; they do not provide instance-level stateful rules and are harder to manage for ongoing traffic flow.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.