A company needs to store data from its healthcare application. The application’s data frequently changes. A new regulation requires audit access at all levels of the stored data.The company hosts the application on an on-premises infrastructure that is running out of storage capacity. A solutions architect must securely migrate the existing data to AWS while satisfying the new regulation.Which solution will meet these requirements?
Answer(s): A
A) AWS DataSync to move data to S3 and CloudTrail logging data eventsA) Correct: DataSync securely migrates on-premises data to S3 with encrypted transfer; enable S3 data events in CloudTrail to meet audit access at all storage levels (object-level). B) Snowcone is for edge devices with limited scope and offline use; CloudTrail management events do not provide data-level audit access. C) S3 Transfer Acceleration speeds transfers but does not address comprehensive object-level auditing; data events in CloudTrail still required. D) Storage Gateway can migrate data but audit requirement is best satisfied with DataSync’s straightforward on-prem-to-S3 transfer and data-level CloudTrail events; management events are insufficient for data audits.
A solutions architect is implementing a complex Java application with a MySQL database. The Java application must be deployed on Apache Tomcat and must be highly available.What should the solutions architect do to meet these requirements?
Answer(s): B
Deploying via AWS Elastic Beanstalk provides a managed platform for Java apps (Tomcat) with built-in high availability through a load-balanced environment and supports rolling deployments, satisfying HA and ease of management.A) Lambda with API Gateway is serverless and not suited for a traditional Tomcat-based Java application requiring a persistent Tomcat container. C) ElastiCache is an in-memory cache, not a primary database, and does not address Tomcat deployment or high availability for the app. D) Self-managing EC2 with manual MySQL and AMI/Auto Scaling lacks the managed platform benefits and may complicate HA and maintenance compared to Elastic Beanstalk.
A serverless application uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The Lambda function needs permissions to read and write to the DynamoDB table.Which solution will give the Lambda function access to the DynamoDB table MOST securely?
B) The Lambda execution role with a policy granting read/write to the DynamoDB table is the secure, scalable, and AWS-recommended approach; no long-term credentials are exposed, and API Gateway/Lambda will assume the role during execution.A) Uses IAM user credentials stored in Lambda environment variables—credentials can be exposed, rotated poorly, and violate least-privilege/zero-trust.C) Storing credentials in Parameter Store then retrieving them in code adds complexity and potential exposure; still relies on long-term credentials.D) DynamoDB is a service, not an entity that assumes roles; Lambda must assume a Lambda execution role, not attach to DynamoDB.
The following IAM policy is attached to an IAM group. This is the only policy applied to the group.What are the effective IAM permissions of this policy for group members?
Answer(s): D
The policy grants specific EC2 actions (StopInstances, TerminateInstances) only in us-east-1 and only when MFA is in use; all other EC2 actions are allowed within us-east-1 only if MFA is not specifically required by the policy, which aligns with option D’s precise scoping.A) Incorrect: it implies full EC2 access in us-east-1 and ignores MFA as a condition; policy limits actions to Stop/Terminate with MFA, not all actions.B) Incorrect: it asserts a denial in us-east-1 without an explicit Deny/Allow MFA condition; IAM policies do not create blanket MFA-based Deny unless specified.C) Incorrect: states allowed for all Regions with MFA for Stop/Terminate; the policy limits region to us-east-1.D) Correct: constrains Stop/Terminate to us-east-1 with MFA; all other EC2 actions allowed within us-east-1.
A manufacturing company has machine sensors that upload .csv files to an Amazon S3 bucket. These .csv files must be converted into images and must be made available as soon as possible for the automatic generation of graphical reports.The images become irrelevant after 1 month, but the .csv files must be kept to train machine learning (ML) models twice a year. The ML trainings and audits are planned weeks in advance.Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
Answer(s): B,C
The correct options B and C provide cost-effective, event-driven processing and appropriate lifecycle management. B uses Lambda triggered by CSV uploads to convert to images in S3, minimizing idle compute and latency for immediate access. C uses S3 Lifecycle to transition CSVs to Glacier after 1 day for cost savings and expires image files after 30 days, aligning with their ephemeral nature while preserving CSVs for semiannual ML training.A is too expensive and unreliable due to Spot interruptions and continuous hourly processing. D and E misclassify access patterns: moving CSVs to IA options or keeping images in RRS increases costs and complexity without added value, given the data access frequency and retention.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.