QUESTION: 253

A company is creating a centralized logging service running on Amazon EC2 that will receive and analyze logs from hundreds of AWS accounts. AWS PrivateLink is being used to provide connectivity between the client services and the logging service.

In each AWS account with a client, an interface endpoint has been created for the logging service and is available. The logging service running on EC2 instances with a Network Load Balancer (NLB) are deployed in different subnets. The clients are unable to submit logs using the VPC endpoint.

Which combination of steps should a solutions architect take to resolve this issue? (Choose two.)

Check that the NACL is attached to the logging service subnet to allow communications to and from the NLB subnets. Check that the NACL is attached to the NLB subnet to allow communications to and from the logging service subnets running on EC2 instances.
Check that the NACL is attached to the logging service subnets to allow communications to and from the interface endpoint subnets. Check that the NACL is attached to the interface endpoint subnet to allow communications to and from the logging service subnets running on EC2 instances.
Check the security group for the logging service running on the EC2 instances to ensure it allows ingress from the NLB subnets.
Check the security group for the logging service running on EC2 instances to ensure it allows ingress from the clients.
Check the security group for the NLB to ensure it allows ingress from the interface endpoint subnets.

Answer(s): A,C

Explanation:

A) Ensuring that the NACL (Network Access Control List) attached to the logging service subnet allows communication to and from the NLB subnets is critical for the traffic flow between the EC2 instances hosting the logging service and the NLB. Similarly, the NACLs on the NLB subnets must allow communication to and from the EC2 instance subnets to ensure the connection works properly.
C) Checking the security group for the EC2 instances running the logging service to ensure it allows ingress from the NLB subnets is crucial. This step ensures that traffic coming from the NLB can reach the logging service hosted on the EC2 instances.
These steps address both the networking and security group configurations to resolve the issue preventing clients from submitting logs through the VPC endpoint.

Reveal Solution Next Question

QUESTION: 254

A company has millions of objects in an Amazon S3 bucket. The objects are in the S3 Standard storage class. All the S3 objects are accessed frequently. The number of users and applications that access the objects is increasing rapidly. The objects are encrypted with server-side encryption with AWS KMS keys (SSE-KMS).

A solutions architect reviews the company’s monthly AWS invoice and notices that AWS KMS costs are increasing because of the high number of requests from Amazon S3. The solutions architect needs to optimize costs with minimal changes to the application.

Which solution will meet these requirements with the LEAST operational overhead?

Create a new S3 bucket that has server-side encryption with customer-provided keys (SSE-C) as the encryption type. Copy the existing objects to the new S3 bucket. Specify SSE-C.
Create a new S3 bucket that has server-side encryption with Amazon S3 managed keys (SSE-S3) as the encryption type. Use S3 Batch Operations to copy the existing objects to the new S3 bucket. Specify SSE-S3.
Use AWS CloudHSM to store the encryption keys. Create a new S3 bucket. Use S3 Batch Operations to copy the existing objects to the new S3 bucket. Encrypt the objects by using the keys from CloudHSM.
Use the S3 Intelligent-Tiering storage class for the S3 bucket. Create an S3 Intelligent-Tiering archive configuration to transition objects that are not accessed for 90 days to S3 Glacier Deep Archive.

Answer(s): B

Explanation:

B) Creating a new S3 bucket with server-side encryption using Amazon S3 managed keys (SSE-S3) and using S3 Batch Operations to copy the existing objects will significantly reduce the AWS KMS costs. SSE-S3 provides encryption without the overhead of using KMS keys, making it a cost-effective alternative while keeping encryption enabled. This solution requires minimal changes to the application and optimizes costs with the least operational overhead.

Reveal Solution Next Question

QUESTION: 255

A media storage application uploads user photos to Amazon S3 for processing by AWS Lambda functions. Application state is stored in Amazon DynamoDB tables. Users are reporting that some uploaded photos are not being processed properly. The application developers trace the logs and find that Lambda is experiencing photo processing issues when thousands of users upload photos simultaneously. The issues are the result of Lambda concurrency limits and the performance of DynamoDB when data is saved.

Which combination of actions should a solutions architect take to increase the performance and reliability of the application? (Choose two.)

Evaluate and adjust the RCUs for the DynamoDB tables.
Evaluate and adjust the WCUs for the DynamoDB tables.
Add an Amazon ElastiCache layer to increase the performance of Lambda functions.
Add an Amazon Simple Queue Service (Amazon SQS) queue and reprocessing logic between Amazon S3 and the Lambda functions.
Use S3 Transfer Acceleration to provide lower latency to users.

Answer(s): B,D

Explanation:

B) Adjusting the WCUs (Write Capacity Units) for the DynamoDB tables will help address write performance issues, especially when large numbers of users are uploading photos simultaneously. DynamoDB's write capacity should be scaled up to handle the increased data ingestion.
D) Adding an Amazon SQS queue between Amazon S3 and the Lambda functions helps decouple the photo upload and processing, allowing the system to handle bursts of traffic without hitting Lambda concurrency limits. SQS will buffer the requests, enabling Lambda to process them asynchronously and reliably.
This combination improves both the performance of DynamoDB and the reliability of the Lambda functions under heavy load.

Reveal Solution Next Question

QUESTION: 256

A company runs an application in an on-premises data center. The application gives users the ability to upload media files. The files persist in a file server. The web application has many users. The application server is overutilized, which causes data uploads to fail occasionally. The company frequently adds new storage to the file server. The company wants to resolve these challenges by migrating the application to AWS.

Users from across the United States and Canada access the application. Only authenticated users should have the ability to access the application to upload files. The company will consider a solution that refactors the application, and the company needs to accelerate application development.

Which solution will meet these requirements with the LEAST operational overhead?

Use AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Modify the application to use Amazon S3 to persist the files. Use Amazon Cognito to authenticate users.
Use AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Set up AWS IAM Identity Center (AWS Single Sign-On) to give users the ability to sign in to the application. Modify the application to use Amazon S3 to persist the files.
Create a static website for uploads of media files. Store the static assets in Amazon S3. Use AWS AppSync to create an API. Use AWS Lambda resolvers to upload the media files to Amazon S3. Use Amazon Cognito to authenticate users.
Use AWS Amplify to create a static website for uploads of media files. Use Amplify Hosting to serve the website through Amazon CloudFront. Use Amazon S3 to store the uploaded media files. Use Amazon Cognito to authenticate users.

Answer(s): D

Explanation:

D) Using AWS Amplify to create a static website for media file uploads with Amplify Hosting and Amazon CloudFront provides a highly scalable and low-maintenance solution. Amazon S3 is ideal for storing the uploaded media files, and Amazon Cognito offers a straightforward method for user authentication. This solution refactors the application with the least operational overhead, leveraging fully managed services for storage, authentication, and content delivery, which accelerates application development.

Reveal Solution Next Question

Free AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL Exam Braindumps (page: 64)

QUESTION: 253

Explanation:

QUESTION: 254

Explanation:

QUESTION: 255

Explanation:

QUESTION: 256

Explanation: