QUESTION: 245

A large company runs workloads in VPCs that are deployed across hundreds of AWS accounts. Each VPC consists of public subnets and private subnets that span across multiple Availability Zones. NAT gateways are deployed in the public subnets and allow outbound connectivity to the internet from the private subnets.

A solutions architect is working on a hub-and-spoke design. All private subnets in the spoke VPCs must route traffic to the internet through an egress VPC. The solutions architect already has deployed a NAT gateway in an egress VPC in a central AWS account.

Which set of additional steps should the solutions architect take to meet these requirements?

Create peering connections between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.
Create a transit gateway, and share it with the existing AWS accounts. Attach existing VPCs to the transit gateway. Configure the required routing to allow access to the internet.
Create a transit gateway in every account. Attach the NAT gateway to the transit gateways. Configure the required routing to allow access to the internet.
Create an AWS PrivateLink connection between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.

Answer(s): B

Explanation:

B) Creating a transit gateway and sharing it with the existing AWS accounts allows the spoke VPCs to route traffic to the egress VPC. By attaching the existing VPCs to the transit gateway, the solution centralizes the outbound traffic flow, enabling private subnets in the spoke VPCs to access the internet through the egress VPC’s NAT gateway. This approach efficiently manages routing and scales across multiple AWS accounts, making it the best fit for the hub-and-spoke design.

Reveal Solution Next Question

QUESTION: 246

An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container Service (Amazon ECS) cluster in an Auto Scaling group behind an Application Load Balancer (ALB). A system administrator detects a weekly spike in the number of failed login attempts, which overwhelm the application's authentication service. All the failed login attempts originate from about 500 different IP addresses that change each week. A solutions architect must prevent the failed login attempts from overwhelming the authentication service.

Which solution meets these requirements with the MOST operational efficiency?

Use AWS Firewall Manager to create a security group and security group policy to deny access from the IP addresses.
Create an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. Connect the web ACL to the AL
Use AWS Firewall Manager to create a security group and security group policy to allow access only to specific CIDR ranges.
Create an AWS WAF web ACL with an IP set match rule, and set the rule action to Block. Connect the web ACL to the ALB.

Answer(s): B

Explanation:

B) Creating an AWS WAF web ACL with a rate-based rule that blocks IP addresses generating excessive failed login attempts is the most operationally efficient solution. This rule can automatically detect and block IP addresses that exceed a specified request threshold, preventing the authentication service from being overwhelmed. The web ACL can be connected to the ALB to provide centralized protection for the entire application. This solution is automated and requires minimal ongoing management.

Reveal Solution Next Question

QUESTION: 247

A company operates an on-premises software-as-a-service (SaaS) solution that ingests several files daily. The company provides multiple public SFTP endpoints to its customers to facilitate the file transfers. The customers add the SFTP endpoint IP addresses to their firewall allow list for outbound traffic. Changes to the SFTP endpoint IP addresses are not permitted.

The company wants to migrate the SaaS solution to AWS and decrease the operational overhead of the file transfer service.

Which solution meets these requirements?

Register the customer-owned block of IP addresses in the company's AWS account. Create Elastic IP addresses from the address pool and assign them to an AWS Transfer for SFTP endpoint. Use AWS Transfer to store the files in Amazon S3.
Add a subnet containing the customer-owned block of IP addresses to a VPC. Create Elastic IP addresses from the address pool and assign them to an Application Load Balancer (ALB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the ALStore the files in attached Amazon Elastic Block Store (Amazon EBS) volumes.
Register the customer-owned block of IP addresses with Amazon Route 53. Create alias records in Route 53 that point to a Network Load Balancer (NLB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the NLB. Store the files in Amazon S3.
Register the customer-owned block of IP addresses in the company’s AWS account. Create Elastic IP addresses from the address pool and assign them to an Amazon S3 VPC endpoint. Enable SFTP support on the S3 bucket.

Answer(s): A

Explanation:

A) Registering the customer-owned block of IP addresses in the company's AWS account and assigning Elastic IP addresses to an AWS Transfer for SFTP endpoint allows the company to maintain the same IP addresses that customers have added to their firewall allow lists. AWS Transfer for SFTP enables secure and managed SFTP file transfers with files stored in Amazon S3, reducing operational overhead by eliminating the need to manage SFTP servers directly.
This solution meets the requirements of preserving IP addresses while decreasing operational effort.

Reveal Solution Next Question

QUESTION: 248

A company has a new application that needs to run on five Amazon EC2 instances in a single AWS Region. The application requires high-throughput, low-latency network connections between all of the EC2 instances where the application will run. There is no requirement for the application to be fault tolerant.

Which solution will meet these requirements?

Launch five new EC2 instances into a cluster placement group. Ensure that the EC2 instance type supports enhanced networking.
Launch five new EC2 instances into an Auto Scaling group in the same Availability Zone. Attach an extra elastic network interface to each EC2 instance.
Launch five new EC2 instances into a partition placement group. Ensure that the EC2 instance type supports enhanced networking.
Launch five new EC2 instances into a spread placement group. Attach an extra elastic network interface to each EC2 instance.

Answer(s): A

Explanation:

A) Launching the EC2 instances into a cluster placement group provides high-throughput, low-latency network connections between instances within the same group. A cluster placement group is designed to achieve low-latency networking by keeping instances physically close together in the same Availability Zone. Ensuring that the EC2 instance type supports enhanced networking further improves network performance.
This solution meets the requirement for high-throughput, low-latency connections between the EC2 instances.

Reveal Solution Next Question

Free AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL Exam Braindumps (page: 62)

QUESTION: 245

Explanation:

QUESTION: 246

Explanation:

QUESTION: 247

Explanation:

QUESTION: 248

Explanation: