QUESTION: 69

A company has an environment that has a single AWS account. A solutions architect is reviewing the environment to recommend what the company could improve specifically in terms of access to the AWS Management Console. The company’s IT support workers currently access the console for administrative tasks, authenticating with named IAM users that have been mapped to their job role.

The IT support workers no longer want to maintain both their Active Directory and IAM user accounts. They want to be able to access the console by using their existing Active Directory credentials. The solutions architect is using AWS IAM Identity Center (AWS Single Sign-On) to implement this functionality.

Which solution will meet these requirements MOST cost-effectively?

Create an organization in AWS Organizations. Turn on the IAM Identity Center feature in Organizations. Create and configure a directory in AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) with a two-way trust to the company’s on-premises Active Directory. Configure IAM Identity Center and set the AWS Managed Microsoft AD directory as the identity source. Create permission sets and map them to the existing groups within the AWS Managed Microsoft AD directory.
Create an organization in AWS Organizations. Turn on the IAM Identity Center feature in Organizations. Create and configure an AD Connector to connect to the company’s on-premises Active Directory. Configure IAM Identity Center and select the AD Connector as the identity source. Create permission sets and map them to the existing groups within the company’s Active Directory.
Create an organization in AWS Organizations. Turn on all features for the organization. Create and configure a directory in AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) with a two-way trust to the company’s on-premises Active Directory. Configure IAM Identity Center and select the AWS Managed Microsoft AD directory as the identity source. Create permission sets and map them to the existing groups within the AWS Managed Microsoft AD directory.
Create an organization in AWS Organizations. Turn on all features for the organization. Create and configure an AD Connector to connect to the company’s on-premises Active Directory. Configure IAM Identity Center and set the AD Connector as the identity source. Create permission sets and map them to the existing groups within the company’s Active Directory.

Answer(s): D

Explanation:

D) Create an organization in AWS Organizations. Turn on all features for the organization. Create and configure an AD Connector to connect to the company’s on-premises Active Directory. Configure IAM Identity Center and set the AD Connector as the identity source. Create permission sets and map them to the existing groups within the company’s Active Directory.

This solution is the most cost-effective and practical for integrating AWS IAM Identity Center (SSO) with the company's existing on-premises Active Directory. The AD Connector provides a cost-efficient option for extending existing Active Directory authentication into AWS without the need to deploy a full AWS Managed Microsoft AD directory. By configuring IAM Identity Center to use the AD Connector as the identity source, IT support workers can access the AWS Management Console with their existing Active Directory credentials, meeting their requirements without adding unnecessary complexity or cost.

Reveal Solution Next Question

QUESTION: 70

A video streaming company recently launched a mobile app for video sharing. The app uploads various files to an Amazon S3 bucket in the us-east-1 Region. The files range in size from 1 GB to 10 GB.

Users who access the app from Australia have experienced uploads that take long periods of time. Sometimes the files fail to completely upload for these users. A solutions architect must improve the app’s performance for these uploads.

Which solutions will meet these requirements? (Choose two.)

Enable S3 Transfer Acceleration on the S3 bucket. Configure the app to use the Transfer Acceleration endpoint for uploads.
Configure an S3 bucket in each Region to receive the uploads. Use S3 Cross-Region Replication to copy the files to the distribution S3 bucket.
Set up Amazon Route 53 with latency-based routing to route the uploads to the nearest S3 bucket Region.
Configure the app to break the video files into chunks. Use a multipart upload to transfer files to Amazon S3.
Modify the app to add random prefixes to the files before uploading.

Answer(s): A,D

Explanation:

A) Enable S3 Transfer Acceleration on the S3 bucket. Configure the app to use the Transfer Acceleration endpoint for uploads.
S3 Transfer Acceleration speeds up uploads by using Amazon CloudFront's globally distributed edge locations to route traffic to the S3 bucket. This reduces latency and improves upload performance, especially for users in distant regions like Australia.

D) Configure the app to break the video files into chunks. Use a multipart upload to transfer files to Amazon S3.
Multipart upload allows large files to be uploaded in smaller parts, which can be retried individually if a part fails, significantly improving the reliability and performance of large uploads (1 GB to 10 GB) by reducing the likelihood of failure during the upload process.

These solutions directly address the performance and reliability issues faced by users in Australia when uploading large files to S3.

Reveal Solution Next Question

QUESTION: 71

An application is using an Amazon RDS for MySQL Multi-AZ DB instance in the us-east-1 Region. After a failover test, the application lost the connections to the database and could not re-establish the connections. After a restart of the application, the application re-established the connections.

A solutions architect must implement a solution so that the application can re-establish connections to the database without requiring a restart.

Which solution will meet these requirements?

Create an Amazon Aurora MySQL Serverless v1 DB instance. Migrate the RDS DB instance to the Aurora Serverless v1 DB instance. Update the connection settings in the application to point to the Aurora reader endpoint.
Create an RDS proxy. Configure the existing RDS endpoint as a target. Update the connection settings in the application to point to the RDS proxy endpoint.
Create a two-node Amazon Aurora MySQL DB cluster. Migrate the RDS DB instance to the Aurora DB cluster. Create an RDS proxy. Configure the existing RDS endpoint as a target. Update the connection settings in the application to point to the RDS proxy endpoint.
Create an Amazon S3 bucket. Export the database to Amazon S3 by using AWS Database Migration Service (AWS DMS). Configure Amazon Athena to use the S3 bucket as a data store. Install the latest Open Database Connectivity (ODBC) driver for the application. Update the connection settings in the application to point to the Athena endpoint.

Answer(s): B

Explanation:

B) Create an RDS proxy. Configure the existing RDS endpoint as a target. Update the connection settings in the application to point to the RDS proxy endpoint.

RDS Proxy improves application availability by managing and pooling database connections. In the event of a failover, RDS Proxy allows the application to re-establish connections to the database without requiring a restart. It provides seamless failover handling, reduces failover time, and minimizes disruptions during failover events, which meets the requirement of re-establishing database connections automatically without restarting the application.

Reveal Solution Next Question

QUESTION: 72

A company is building a solution in the AWS Cloud. Thousands or devices will connect to the solution and send data. Each device needs to be able to send and receive data in real time over the MQTT protocol. Each device must authenticate by using a unique X.509 certificate.

Which solution will meet these requirements with the LEAST operational overhead?

Set up AWS IoT Core. For each device, create a corresponding Amazon MQ queue and provision a certificate. Connect each device to Amazon MQ.
Create a Network Load Balancer (NLB) and configure it with an AWS Lambda authorizer. Run an MQTT broker on Amazon EC2 instances in an Auto Scaling group. Set the Auto Scaling group as the target for the NL Connect each device to the NL
Set up AWS IoT Core. For each device, create a corresponding AWS IoT thing and provision a certificate. Connect each device to AWS IoT Core.
Set up an Amazon API Gateway HTTP API and a Network Load Balancer (NLB). Create integration between API Gateway and the NLB. Configure a mutual TLS certificate authorizer on the HTTP API. Run an MQTT broker on an Amazon EC2 instance that the NLB targets. Connect each device to the NLB.

Answer(s): C

Explanation:

C) Set up AWS IoT Core. For each device, create a corresponding AWS IoT thing and provision a certificate. Connect each device to AWS IoT Core.

AWS IoT Core is a fully managed service designed to handle large-scale device communication via the MQTT protocol. It allows each device to authenticate using X.509 certificates and supports real-time communication. This solution minimizes operational overhead as AWS IoT Core provides built-in device management, secure communication, and certificate handling, making it the best option for a scalable and secure IoT solution with minimal management effort.

Reveal Solution Next Question

Free AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL Exam Braindumps (page: 18)

QUESTION: 69

Explanation:

QUESTION: 70

Explanation:

QUESTION: 71

Explanation:

QUESTION: 72

Explanation: