A company has an asynchronous HTTP application that is hosted as an AWS Lambda function. A public Amazon API Gateway endpoint invokes the Lambda function. The Lambda function and the API Gateway endpoint reside in the us-east-1 Region. A solutions architect needs to redesign the application to support failover to another AWS Region.Which solution will meet these requirements?
Answer(s): D
D) Deploy the Lambda function and an API Gateway endpoint to the us-west-2 Region. Configure Amazon Route 53 to use a failover routing policy to route traffic for the two API Gateway endpoints.This solution ensures that both the Lambda function and the API Gateway are deployed in the secondary region (us-west-2), providing a complete failover setup. By using Amazon Route 53 with a failover routing policy, traffic can be directed to the primary region (us-east-1) unless it is unhealthy, at which point it will automatically route traffic to the backup in the secondary region. This setup meets the requirement for failover while ensuring that the application remains operational in the event of a regional failure.
A retail company has structured its AWS accounts to be part of an organization in AWS Organizations. The company has set up consolidated billing and has mapped its departments to the following OUs: Finance, Sales, Human Resources (HR), Marketing, and Operations. Each OU has multiple AWS accounts, one for each environment within a department. These environments are development, test, pre-production, and production.The HR department is releasing a new system that will launch in 3 months. In preparation, the HR department has purchased several Reserved Instances (RIs) in its production AWS account. The HR department will install the new application on this account. The HR department wants to make sure that other departments cannot share the RI discounts.Which solution will meet these requirements?
Answer(s): C
To prevent other departments from sharing the Reserved Instance (RI) discounts in the HR department's production AWS account, you need to manage the RI sharing settings at the organizational level.Option C allows you to use the management account of the AWS Organization to turn off RI sharing specifically for the HR department's production account. This ensures that the RIs purchased by the HR department will only apply to that account and cannot be utilized by any other accounts in the organization, effectively isolating the RI discounts as required.Other options either do not directly address the need to restrict RI sharing (like A), would unnecessarily remove the account from the organization (B), or would not effectively prevent sharing as SCPs cannot restrict RI sharing directly (D). Thus, option C is the most suitable and efficient solution for the given requirements.
A large company is running a popular web application. The application runs on several Amazon EC2 Linux instances in an Auto Scaling group in a private subnet. An Application Load Balancer is targeting the instances in the Auto Scaling group in the private subnet. AWS Systems Manager Session Manager is configured, and AWS Systems Manager Agent is running on all the EC2 instances.The company recently released a new version of the application. Some EC2 instances are now being marked as unhealthy and are being terminated. As a result, the application is running at reduced capacity. A solutions architect tries to determine the root cause by analyzing Amazon CloudWatch logs that are collected from the application, but the logs are inconclusive.How should the solutions architect gain access to an EC2 instance to troubleshoot the issue?
To troubleshoot the issue with the unhealthy EC2 instances in the Auto Scaling group, the solutions architect should suspend the Auto Scaling group's Terminate process. This allows the affected instance to remain running even if it is marked as unhealthy. Once suspended, the architect can use AWS Systems Manager Session Manager to gain access to the instance without needing to rely on SSH access, which is especially useful in a private subnet where direct access may not be available.Option D is the best approach because it ensures the instance stays up for investigation, allowing for troubleshooting of the application issues that are causing the unhealthy status. The other options either do not prevent termination of the instance or do not directly facilitate access for troubleshooting.
A company wants to deploy an AWS WAF solution to manage AWS WAF rules across multiple AWS accounts. The accounts are managed under different OUs in AWS Organizations.Administrators must be able to add or remove accounts or OUs from managed AWS WAF rule sets as needed. Administrators also must have the ability to automatically update and remediate noncompliant AWS WAF rules in all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?
Answer(s): A
The most efficient way to manage AWS WAF rules across multiple accounts in an organization is to use AWS Firewall Manager. This service allows centralized management of WAF rules, making it easier for administrators to add or remove accounts or OUs as needed.Option A provides a streamlined approach by leveraging AWS Firewall Manager for rule management while using AWS Systems Manager Parameter Store to dynamically store and update the account numbers and OUs. The integration with Amazon EventBridge and AWS Lambda facilitates automated updates and remediation for noncompliant WAF rules across all accounts. This setup requires minimal operational overhead, as administrators can manage the parameter store easily and trigger necessary updates without extensive manual intervention.The other options involve more complex setups or require more manual processes, which could lead to increased operational overhead, making Option A the most suitable choice for the given requirements.
A solutions architect is auditing the security setup or an AWS Lambda function for a company. The Lambda function retrieves, the latest changes from an Amazon Aurora database. The Lambda function and the database run in the same VPC. Lambda environment variables are providing the database credentials to the Lambda function.The Lambda function aggregates data and makes the data available in an Amazon S3 bucket that is configured for server-side encryption with AWS KMS managed encryption keys (SSE-KMS). The data must not travel across the Internet. If any database credentials become compromised, the company needs a solution that minimizes the impact of the compromise.What should the solutions architect recommend to meet these requirements?
To enhance the security of the AWS Lambda function and mitigate the risks associated with compromised database credentials, the recommended approach is to enable IAM database authentication for the Amazon Aurora database and use an IAM role for the Lambda function. This eliminates the need to store sensitive credentials directly within the Lambda function's environment variables.Option A effectively addresses these requirements by:1.Enabling IAM Database Authentication: This allows the Lambda function to authenticate to the Aurora database using temporary security credentials, which reduces the risk associated with static credentials.2.Changing the IAM Role: The Lambda function’s IAM role is modified to grant permissions necessary for accessing the database using IAM authentication.3.Deploying a Gateway VPC Endpoint for S3: This ensures that all data transfers between the Lambda function and the S3 bucket occur over the AWS network without traversing the public internet, thereby enhancing security.This solution minimizes the impact of any potential compromise of database credentials while ensuring that the data remains secure during transfers.Other options, while they may provide some level of security, do not fully address the requirement to eliminate stored credentials or may not guarantee that data remains within the AWS network. For instance, Options C and D suggest using AWS Systems Manager Parameter Store or Secrets Manager, which are valid for managing credentials but do not directly address the request to minimize the impact of compromised credentials as effectively as IAM database authentication.
A large mobile gaming company has successfully migrated all of its on-premises infrastructure to the AWS Cloud. A solutions architect is reviewing the environment to ensure that it was built according to the design and that it is running in alignment with the Well-Architected Framework.While reviewing previous monthly costs in Cost Explorer, the solutions architect notices that the creation and subsequent termination of several large instance types account for a high proportion of the costs. The solutions architect finds out that the company’s developers are launching new Amazon EC2 instances as part of their testing and that the developers are not using the appropriate instance types.The solutions architect must implement a control mechanism to limit the instance types that only the developers can launch.Which solution will meet these requirements?
To effectively control the instance types that developers can launch in Amazon EC2 while ensuring alignment with the organization's cost management strategy, the best approach is to use an IAM policy that explicitly restricts the allowed instance types.Option C is the most suitable solution for the following reasons:1.IAM Policy Creation: By creating a new IAM policy that specifies the allowed instance types, you can enforce which EC2 instance types developers are permitted to launch. This prevents them from launching more expensive or inappropriate instance types that lead to unnecessary costs.2.Attaching to IAM Group: The policy can be attached to an IAM group that includes all the developers. This makes it easier to manage permissions collectively rather than having to adjust individual IAM accounts.3.Least Privilege Principle: This approach adheres to the principle of least privilege by restricting access only to the necessary instance types required for their work, thereby reducing the likelihood of cost overruns due to unintentional usage of more expensive resources.Other options, such as using AWS Config (Option A) or launch templates (Option B), do not provide the same level of direct control over the instance types allowed for specific users. Option D, using EC2 Image Builder, does not address the requirement of limiting instance types and is unrelated to the cost issue identified. Thus, Option C provides a targeted and effective solution for the problem at hand.
A company is developing and hosting several projects in the AWS Cloud. The projects are developed across multiple AWS accounts under the same organization in AWS Organizations. The company requires the cost for cloud infrastructure to be allocated to the owning project. The team responsible for all of the AWS accounts has discovered that several Amazon EC2 instances are lacking the Project tag used for cost allocation.Which actions should a solutions architect lake to resolve the problem and prevent it from happening in the future? (Choose three.)
Answer(s): A,B,E
To ensure all EC2 instances have the necessary Project tag for cost allocation:-A. Create an AWS Config rule in each account to find resources with missing tags. This helps continuously monitor and report on instances that lack the required tag.-B. Create an SCP in the organization with a deny action for ec2:RunInstances if the Project tag is missing. This enforces tagging at the account level, preventing instances from being launched without the Project tag.-E. Create an AWS Config aggregator for the organization to collect a list of EC2 instances with the missing Project tag. This allows centralized visibility across multiple accounts, facilitating easier management and compliance verification.These actions collectively help enforce and monitor tagging compliance across AWS accounts.
A company has an on-premises monitoring solution using a PostgreSQL database for persistence of events. The database is unable to scale due to heavy ingestion and it frequently runs out of storage.The company wants to create a hybrid solution and has already set up a VPN connection between its network and AWS. The solution should include the following attributes:-Managed AWS services to minimize operational complexity.-A buffer that automatically scales to match the throughput of data and requires no ongoing administration.-A visualization tool to create dashboards to observe events in near-real time.-Support for semi-structured JSON data and dynamic schemas.Which combination of components will enable the company to create a monitoring solution that will satisfy these requirements? (Choose two.)
Answer(s): A,D
To create a hybrid monitoring solution that meets the specified requirements:A) Use Amazon Kinesis Data Firehose to buffer events. Create an AWS Lambda function to process and transform events. Kinesis Data Firehose automatically scales to match data throughput and can handle semi-structured JSON data, providing a reliable buffer for event ingestion.D) Configure Amazon Elasticsearch Service (Amazon ES) to receive events. Use the Kibana endpoint deployed with Amazon ES to create near-real-time visualizations and dashboards. Amazon ES is designed for indexing and searching large volumes of data, including semi-structured JSON, and Kibana allows for creating interactive dashboards to visualize the data in real time.This combination minimizes operational complexity while providing the necessary capabilities for the company's monitoring needs.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.