A rapidly growing global ecommerce company is hosting its web application on AWS. The web application includes static content and dynamic content. The website stores online transaction processing (OLTP) data in an Amazon RDS database The website’s users are experiencing slow page loads.Which combination of actions should a solutions architect take to resolve this issue? (Choose two.)
Answer(s): B,D
Static content should be cached at edge with a CDN, and database read scaling reduces OLTP latency; CloudFront (B) serves static/dynamic content with low latency, and a DB read replica (D) offloads read traffic from the primary RDS instance, improving response times. A) Redshift is for data warehousing, not for web content caching or OLTP performance. C) Hosting dynamic content in S3 is not suitable for dynamic, server-side processing unless paired with a compute layer; it doesn’t inherently reduce DB latency. E) Multi-AZ improves availability and durability, not read-scaling or edge caching, so it does not address slow loads.
A company uses Amazon EC2 instances and AWS Lambda functions to run its application. The company has VPCs with public subnets and private subnets in its AWS account. The EC2 instances run in a private subnet in one of the VPCs. The Lambda functions need direct network access to the EC2 instances for the application to work.The application will run for at least 1 year. The company expects the number of Lambda functions that the application uses to increase during that time. The company wants to maximize its savings on all application resources and to keep network latency between the services low.Which solution will meet these requirements?
Answer(s): C
A) Incorrect: EC2 Instance Savings Plan does not cover Lambda usage; also needs private subnet without cross-VPC routing concerns. B) Incorrect: Public subnets increase exposure and do not minimize latency between private EC2 and Lambda; data transfer optimization is not the primary savings mechanism, and public subnet access is not ideal for private resources. C) Correct: Compute Savings Plan covers both Lambda and EC2 usage with flexible coverage; connecting Lambda to the private subnet containing EC2 instances minimizes latency and keeps inter-service traffic within the VPC, meeting low latency and long-term savings. D) Incorrect: Lambda in the Lambda service VPC introduces extra NAT/endpoint considerations and limits network integration; Compute Savings Plan already addresses long-term savings without needing the managed VPC for Lambda.
A solutions architect needs to allow team members to access Amazon S3 buckets in two different AWS accounts: a development account and a production account. The team currently has access to S3 buckets in the development account by using unique IAM users that are assigned to an IAM group that has appropriate permissions in the account.The solutions architect has created an IAM role in the production account. The role has a policy that grants access to an S3 bucket in the production account.Which solution will meet these requirements while complying with the principle of least privilege?
Answer(s): B
The correct answer (B) establishes cross-account access by allowing principals from the development account to assume the role in the production account, aligning with least privilege since access is granted only via the specific role and its S3 permissions.A) Attaching Administrator Access to development users grants excessive privileges across accounts and violates least privilege.C) Turning off S3 Block Public Access does not address cross-account access and can increase exposure.D) Creating separate production accounts users adds management overhead and still requires cross-account access control; role assumption is more scalable and secure.
A company uses AWS Organizations with all features enabled and runs multiple Amazon EC2 workloads in the ap-southeast-2 Region. The company has a service control policy (SCP) that prevents any resources from being created in any other Region. A security policy requires the company to encrypt all data at rest.An audit discovers that employees have created Amazon Elastic Block Store (Amazon EBS) volumes for EC2 instances without encrypting the volumes. The company wants any new EC2 instances that any IAM user or root user launches in ap-southeast-2 to use encrypted EBS volumes. The company wants a solution that will have minimal effect on employees who create EBS volumes.Which combination of steps will meet these requirements? (Choose two.)
Answer(s): C,E
C) EBS volume encryption can be enforced at the organization level by an SCP denying ec2:CreateVolume when ec2:Encrypted is false, ensuring all new volumes in the OU obey encryption without affecting existing workflows in the region.E) Default EBS volume encryption setting in Organizations applies to new volumes created by accounts within the org, providing a streamlined, centralized enforcement with minimal user disruption.A) Incorrect: console default attribute does not enforce at creation or across accounts; it’s a UI setting only.B) Incorrect: permission boundaries apply to principals, not SCPs; root OU would be bypassed by other accounts.D) Incorrect: updating per-account IAM policies is more invasive and bypassable compared to SCPs and default settings.
A company wants to use an Amazon RDS for PostgreSQL DB cluster to simplify time-consuming database administrative tasks for production database workloads. The company wants to ensure that its database is highly available and will provide automatic failover support in most scenarios in less than 40 seconds. The company wants to offload reads off of the primary instance and keep costs as low as possible.Which solution will meet these requirements?
Answer(s): D
A short explanation: D is correct because a Multi-AZ DB cluster with a reader endpoint provides automatic failover support and offloads reads to dedicated read endpoints (readers) while keeping cost-efficient scaling for PostgreSQL on RDS. The reader endpoint distributes read traffic to Aurora-style reader instances in the cluster, with high availability and quick failover. A) Incorrect: Multi-AZ DB instance with a single read replica does not provide automatic failover to the replica for reads; failover is to the secondary AZ primary only. B) Incorrect: Two read replicas increase cost and management; still not optimized for automatic failover of reads. C) Incorrect: Pointing reads to secondary instances in a Multi-AZ pair uses the standby and can cause higher failover impact; not designed for scalable reads.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.